The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed on Wednesday that it is currently investigating a major cybersecurity incident. The breach has been attributed to the Qilin ransomware group, which has publicly claimed responsibility for the attack.

In an official statement, the ATF sought to reassure the public and stakeholders regarding the scope of the intrusion. The agency reported that the unauthorized access was limited to a standalone system that operates independently from the main agency network. According to the ATF, this containment means that critical infrastructure, including the agency’s primary enterprise network and the eForms system used for processing firearm transactions, does not appear to have been compromised or affected by the incident.

While the agency has confirmed the investigation is ongoing, it has not provided specific details regarding what data may have been accessed on the isolated system or the timeline for a full recovery. The involvement of the Qilin ransomware group—a known cybercriminal organization—highlights the ongoing threat posed by ransomware actors against federal agencies. The ATF continues to work with cybersecurity experts to assess the impact and secure the affected environment.