ATF Hack: Qilin Leaks 6.3GB, Agency Says NFA Data Safe

The leak-site entry that sat empty for five days is no longer empty. Qilin posted a 72-hour countdown against the Bureau on Friday, August 28, and when it expired on Monday, August 31 the group marked the ATF listing published and released the material. Cybernews, which reviewed the trove first, puts it at roughly 6.3GB of internal files. ATF told the outlet it planned to issue a statement on the published data; that statement had not appeared as of the evening of August 31, 2026, and the agency has not confirmed the material is authentic.

What Cybernews describes in the directory tree is enforcement material, not applicant paperwork. The parent directories are organized around individual investigations and field operations, including folders labeled “LAREDO Field Office” and “atf-houston,” with subfolders named after specific people of interest and the exact phones or accounts tied to them. The files include mobile-device extractions naming Apple iPhones, Samsung Galaxy models, SIM cards, and iCloud data, along with Cellebrite phone dumps, the Israeli forensics platform most US law enforcement agencies use to pull data off seized devices. Cybernews also found account identifiers, IP addresses, and verified phone numbers, some appearing in file names next to named individuals, a directory labeled “ARMORED TRUCK ROBBERY SERIES 22-23,” and enough detail about ATF's own IT environment to identify the endpoint protection software and version it runs.

That content is consistent with what ATF and its spokesperson described from the first day, a standalone system holding information about investigative targets, and consistent with the CALEA identification the Director gave on August 29. It is also the reason the major incident designation was applied. The people exposed by investigative and forensic material are not only the subjects of cases; they are witnesses, cooperators, and the roughly 1,400 local task force officers who work alongside ATF agents. For an ordinary NFA filer, nothing in the published material has been described as touching applicant records, and the practical guidance below is unchanged.

ATF published a press release on Wednesday, August 26, 2026 stating that it is responding to a cybersecurity incident affecting a standalone system. The agency says that system operates separately from the ATF enterprise network, and that there is no indication the incident has affected the enterprise network, the eForms system, or any other ATF system. On discovery, ATF says it immediately terminated connections to the affected environment and began incident-response and forensic work, and that it is coordinating with the Department of Justice on the investigation. Senior Department officials designated the event a major incident under federal guidelines, and ATF says required notifications have been completed. The release closes by saying the incident has not impacted ATF's ability to perform its missions, and asks anyone with information to call the ATF Tipline at 1-888-ATF-TIPS.

An ATF spokesperson told Recorded Future News the machine held information about targets of ATF investigations, a different population from the ordinary applicants whose paperwork moves through the NFA pipeline. Three days later the agency named the system outright.

Three things remain unanswered, and they are the three that determine how serious this ends up being. ATF has not said when the intrusion occurred, has not said how the system was reached, and has not said whether any data was successfully copied off it. Confirming an incident is not the same as confirming a data theft, and the agency's statement carefully stops short of the second.

On Saturday, August 29, 2026, ATF Director Robert Cekada said the compromised machine was the ATF CALEA system, a standalone system the agency uses in connection with the federal Communications Assistance for Law Enforcement Act. He framed the statement as a correction to claims circulating about the incident, repeated that the system was separate from ATF's other systems and networks, and said the agency would release more as the investigation allows. That is the first public identification of the system. The August 26 press release named nothing beyond “a standalone system.”

CALEA, signed into law on October 25, 1994, requires telecommunications carriers and equipment makers to build their networks so a specific subscriber's communications and call-identifying information can be isolated and handed to the government under proper legal authorization. It is the plumbing behind court-authorized wiretaps and call-record orders, and an agency-side CALEA system is the equipment and process an investigating agency uses to work that pipeline. Cekada stopped there. ATF has not said whether the system held intercept content, subscriber and call-detail records, or only the administrative workflow around authorized requests, and it has not said how many investigations or people the records touch.

The identification does two things at once. It squares the earlier spokesperson description, because court-authorized surveillance material on investigative subjects is exactly “information about targets of ATF investigations.” And it explains the gap between a single isolated machine and a major incident classification: material tied to lawful intercept is among the most sensitive a law enforcement agency generates, since it reveals who is under surveillance and, by implication, who is not. It also puts the intrusion firmly on the enforcement side of the agency, further from the applicant records than the first-day reporting could establish.

The phrase is a formal federal classification, not an adjective. The Federal Information Security Modernization Act directs the Office of Management and Budget to define what counts as a major incident and requires agencies to report one to Congress within seven days of identifying it. OMB guidance reserves the label for incidents involving classified or otherwise protected information, or incidents likely to cause demonstrable harm to national security interests, foreign relations, the economy, or the public confidence, civil liberties, or safety of the American people.

Read that against what ATF actually said and the designation carries real weight without resolving the open questions. The agency confined the intrusion to one isolated machine and said its mission capability is intact, yet senior DOJ officials still elevated the event to a classification that puts it in front of Congress. That combination is consistent with a small blast radius holding unusually sensitive contents, which is exactly what a system of investigative-target records would be. It is not, by itself, evidence that a large volume of data left the building.

Qilin added the Bureau of Alcohol, Tobacco, Firearms and Explosives to its dark web leak site on the morning of August 26, hours before ATF published its statement, as one of six new victims in a batch otherwise drawn from industrial and manufacturing companies. ATF was the outlier and the only federal law enforcement agency in the group. For five days the entry carried no proof at all: no intrusion date, no claimed data volume, no description of what was taken, and no sample files, while three of the five other victims posted that same morning each carried dozens of samples. That gap is what made the claim unverifiable through the first week.

The countdown on August 28 and the publication on August 31 closed it. Whether the material is complete or authentic is still ATF's to confirm, and the agency has named no adversary at any point: its release describes an incident and an ongoing investigation without attributing either. But the sequence now reads the way a standard double-extortion negotiation reads when it fails, and the published directory names are specific enough to ATF field operations that fabrication is the harder explanation.

Qilin is a Russian-linked ransomware-as-a-service operation first observed by researchers in 2022. Operators rent its tooling, break into a target, steal data, encrypt systems, and publish the victim's name to force payment. It is among the most prolific groups currently operating, with Cybernews reporting roughly 1,900 victims claimed over the past 18 months and 891 listed so far in 2026, and recent claimed victims including Sysco, Cushman & Wakefield, Danone, and the German political party Die Linke.

ATF singled out eForms by name as a system the incident did not reach, and the portal has stayed online and kept processing NFA applications through the disclosure. On August 26, eforms.atf.gov served its standard login page reporting version 3.6.3-2026-08-18 in the footer, with the usual Form 1 notice stating that the average processing time for a Form 1 submitted through eForms was 57 days in July. That tracks with the 59-day June average ATF published on its own processing-times page, so the queue is moving at its normal pace rather than stalling. Our suppressor wait-time tracker carries the running series for both ATF averages and dealer medians.

Two independent signals now point the same direction: the agency's own scope statement and the observable behavior of the portal. That is meaningfully stronger than uptime alone, which never proved much, because double extortion frequently involves stealing data without encrypting anything and produces no visible downtime at all. The remaining caveat is that ATF is describing an investigation still in progress, and first-week scope statements do get revised once forensics finish.

The reason a federal firearms agency being breached lands harder than a retail breach is the material ATF holds, even though the agency says none of it sat on the compromised system. A Form 1 or Form 4 submitted through eForms carries the applicant's name, address, date of birth, a photograph, and fingerprints, and on a trust or legal-entity filing it carries that same set for every responsible person. That is a far richer identity package than a leaked email list, and it is attached to a specific firearm application. Our Form 4 walkthrough covers exactly what goes into that submission, and our breakdown of what records the government actually keeps on gun owners covers the rest of the pile.

Approved applications populate the National Firearms Registration and Transfer Record, the federal registry that ties each registered suppressor, short-barreled rifle, machine gun, and other NFA item to the person or entity that registered it. Separately, when a licensed dealer closes, its Form 4473 records go to ATF's National Tracing Center in Martinsburg, West Virginia, and are imaged into the out-of-business records system. A 4473 carries the buyer's name, address, and date of birth alongside the make, model, and serial number of the firearm.

ATF's own position this year is that it collects more of this than it needs. The July 2026 proposed rule (RIN 1140-AA63) would drop individual applicants from two fingerprint cards to one, let any applicant submit a copy of a photo ID instead of the 2x2 passport photograph, and exempt trust responsible persons from fingerprints unless the FBI specifically asks. Comments close October 5, 2026, and the rule is not in effect. A confirmed intrusion anywhere inside the agency is the sharpest available argument for the position that rule already takes: every identity artifact ATF stops holding is one that cannot be stolen.

One broader change is already live. Since October 9, 2026, ATF does not enforce the Form 4 approval and registration requirements for suppressors, SBRs, SBSs, and AOWs, as a matter of enforcement discretion. Where state and local law allow an unregistered suppressor, a buyer can take one home on a 4473 and a NICS check without filing a Form 4 at all, and that transfer creates no new NFA registration record. Buyers in states that tie possession to federal registration can still file a voluntary eForm 4. Our suppressor buying guide tracks current eForm waits and which route applies.

ATF is the third confirmed federal incident of 2026, on top of a fourth last fall, and the closest parallel is the first one. In early March the FBI disclosed that intruders had reached the network used to manage court-authorized wiretaps and surveillance warrants, an intrusion the bureau later linked to China and classified as a major incident under the same federal cybersecurity law ATF is now operating under. With ATF's system now identified as its CALEA environment, both incidents land on the same functional category of infrastructure: the agency-side apparatus for court-authorized electronic surveillance. On July 3 the Department of Homeland Security said it was investigating a breach of the information-sharing network it uses with foreign law enforcement, which lawmakers described as exposing highly sensitive unclassified data.

Last fall a hack at FEMA exposed personal data belonging to FEMA and Customs and Border Protection employees. Cybernews reported separately that more than 75 percent of US government websites suffered a data breach in 2025. The pattern across those cases is worth noting for what happens next here: initial scope statements described contained intrusions, and the fuller picture arrived weeks later.

For an ordinary NFA filer there is still no protective action to take. No category of applicant record has been identified as compromised, the published files reviewed so far are investigative rather than administrative, and no individual breach notice has gone out. ATF has named eForms as unaffected and described the hit system as isolated from case management. Two habits are still worth adopting while the investigation runs.

First, treat any email, text, or phone call referencing an ATF breach as hostile until proven otherwise. A confirmed federal incident is a phishing accelerant: impersonation campaigns follow the headlines and ask people to verify their information or re-authenticate an account. Treat any unsolicited request for your password or full identifying details as fraudulent, and confirm anything that looks official through eForms or ATF's own published contact channels.

Second, if the password on your eForms account is reused anywhere else, change it now. Credential reuse is a routine entry path for ransomware crews, and this is worth doing regardless of how the scope resolves. The thing to watch from here is ATF's response to the published trove: whether the agency authenticates the material, and whether its account of the scope survives contact with what is now sitting in public.