ATF Data Breach

On August 26, 2026, the Qilin ransomware group posted a claim against the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), a US federal law enforcement agency. SOCRadar’s Dark Web Monitoring service identified this listing, which remains unverified by independent sources. The ATF, responsible for enforcing laws related to firearms, explosives, arson, alcohol, and tobacco, falls under the Government & Defense sector. While Qilin has previously targeted public sector organizations such as PenLink, the City of Winchester, the Naval Interior Team, and Mairie de Drancy, an extortion claim against a US federal agency represents a notable escalation in their operational scope and audacity. This claim, if confirmed, would signify a significant development in the Qilin threat actor’s campaign. Previously, Qilin’s public victimology has included several government and defense entities across different countries, but targeting a U.S. federal law enforcement agency is a distinct and potentially more provocative move compared to their prior activities. The timing of the posting also coincides with other indicators of compromise, suggesting a potential, albeit unconfirmed, link between the Qilin claim and recent system activity observed by SOCRadar.

SOCRadar’s analysis focused on the domain atf[.]gov, which returned 25 records dated August 25, 2026. These records were logged within a concentrated two-hour period (20:06-23:07 UTC), suggesting a rapid exfiltration event or a discrete dump of data rather than routine activity. This observation is noteworthy given the Qilin claim was posted the following day. The records comprised 7 classified as external-user accounts on ATF infrastructure and 18 with masked usernames, making their classification as internal or external personnel uncertain. Specifically, the telemetry identified 14 records with masked handles on app.atf[.]gov, such as app****, gma****, ame****, and nic****k. Additionally, eforms.atf[.]gov showed 9 records, including both masked handles and @gmail.com addresses. The presence of masked usernames hinders definitive identification of whether these accounts belong to ATF personnel or external users of the portals. The concentration of records on app.atf[.]gov is particularly significant and warrants an immediate audit of access logs dating back to August 24, 2026. The overall profile of user types observed in these logs is classified as Mixed. Qilin and its associated initial access brokers are known to acquire credentials from underground markets to gain unauthorized access to government portals and remote access systems before deploying ransomware. While the telemetry data does not definitively confirm this intrusion vector was used against the ATF, the timing of the credential exposure logs, occurring immediately prior to the Qilin claim, is highly suggestive. Therefore, the credential records found for app.atf[.]gov and eforms.atf[.]gov should be treated as high-priority targets for remediation.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.