US agency declares 'major incident' after ransomware gang claims cyberattack
What's the story
The US Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has classified a recent cyberattack on one of its systems as a "major incident." This formal classification requires the bureau to notify lawmakers in Congress. The attack targeted a stand-alone system that is not part of the main ATF network. An ATF spokesperson told reporters that this system held information like "targets of ATF investigations."
Ransomware involvement
Qilin ransomware gang claims attack on leak site
The Qilin ransomware gang has claimed responsibility for the ATF cyberattack on its leak site. However, they didn't provide any proof to back their claim, like a sample of leaked data.
Known for its "ransomware-as-a-service" model, Qilin rents out its hacking tools to other criminal affiliates in exchange for a share of the profits.
The gang has listed media giant Lee Enterprises and UK-based pathology lab Synnovis as targets.
Incident classification
What does the 'major incident' classification mean?
Under federal law, "major incidents" are defined as significant cyber events that could cause demonstrable harm to US national security or broader interests.
Agencies must report such incidents to Congress within a week of their discovery.
The ATF's classification of this cyberattack as a major incident is in line with this requirement and follows similar actions by other government agencies after breaches in recent years.