Hackers leak sensitive data apparently stolen from Bureau of Alcohol, Tobacco, Firearms and Explosives

By Sean Lyngaas, CNN

(CNN) — A likely Russian-speaking cybercriminal gang on Monday leaked what appear to be sensitive law enforcement files it stole from the Justice Department’s Bureau of Alcohol, Tobacco, Firearms and Explosives.

The dumped files appear to include information on targets of past ATF investigations and analyses of their phone communications, according to a review of the data by CNN and an independent cybersecurity researcher. Some of the files correspond to specific ATF agents and high-profile cases they apparently worked on.

The data cover investigations related to armed robbery, arson, explosives and homicide, according to the researcher, Ron Fabela. A chunk of the cases mentioned in the files fall under the work the ATF’s Houston Field Division, Fabela said.

In a statement on Monday, ATF said it “cannot confirm the authenticity, nature, or scope” of the leaked data at this time and that the agency was working with the Department of Justice and other federal agencies to “assess the claims and take appropriate actions.”

“As ATF previously stated, the affected system was not connected to – and the incident did not affect – ATF’s other operational systems. ATF’s ability to carry out its mission has not been impacted,” the agency’s statement continued.

ATF originally disclosed the hack last week, saying it met the threshold for a “major” cybersecurity incident that requires notifying Congress. Under federal law, a “major” cyber incident is generally one that could harm US national security, foreign policy or economic interests.

A prolific ransomware group called Qilin previously claimed responsibility for the breach; on Monday, the group began leaking the files from its dark -web victim site. The group has claimed victims in the manufacturing, retail and healthcare sectors in recent years, leading Cisco’s cyber-intelligence unit to brand it one of the “most prolific and damaging ransomware threats on a global scale.”

Halcyon, another cybersecurity firm that tracks ransomware groups, has said it has “high-confidence” that Qilin are Russian speakers.

The ATF hack is the latest headache for federal agencies involving the cybercriminals they often pursue. A 2023 ransomware attack on the US Marshals Service affected personal information of the subjects of the service’s investigations. That same year, hackers breached a computer system the FBI’s New York field office used in investigations of images of child sexual exploitation, including a system used to store images related to the investigation of Jeffrey Epstein, according to people briefed on the matter.

The-CNN-Wire
™ & © 2026 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.