Ransomware gang leaks sensitive files from ATF investigations


This recording was made using enhanced software.

Full story

Highly sensitive files related to criminal investigations by the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) have been leaked after the agency refused to pay a ransomware gang.

The gang, known as Qilin, made the files available to download on its dark web leak site on Monday. The data includes phone records and forensic evidence, according to Cybernews. Material reportedly relates to investigations of crimes such as armed robbery, arson and homicide.

QR code for SAN app download

Download the Straight Arrow app today to get the stories that matter free from manipulation, bias or agenda.™

Point phone camera here

Qilin had given the ATF 72 hours to pay an undisclosed ransom in exchange for not releasing the files. The hackers announced they had breached the ATF more than a week ago.

In a statement after the material was posted online, the ATF confirmed that a “legacy, standalone system,” used in connection with the federal Communications Assistance for Law Enforcement Act, had been accessed.

“ATF is aware of claims concerning the publication of data obtained from an ATF standalone system,” the agency wrote.

But the ATF said it could not “confirm the authenticity, nature, or scope of the material at issue” and that an investigation with the Department of Justice and other federal agencies was underway.

“Given the ongoing review and investigation, ATF cannot provide additional details at this time,” the statement concluded.

Possible Russian ties

The leak exposed the names of person of interest in criminal cases, as well as data that investigators had extracted from cell phones, according to Cybernews. IP addresses and verified phone numbers were also present throughout.

Directory names appeared to refer to specific investigations, including one called “ARMORED TRUCK ROBBERY SERIES 22-23.”

Numerous cybersecurity firms that track ransomware gangs have labeled Qilin with high-confidence as being comprised of Russian speakers.

Qilin made headlines in 2024 in connection to a hack that led to disruptions for the United Kingdom’s National Health Service.

Round out your reading

Tags: ,

Straight Arrow
Fear No Fact.

Don't just take our word for it.


Center-rated reporting

According to media bias experts at AllSides

AllSides Center-rated reporting May 2026

Transparent and credible

Awarded a perfect reliability rating from NewsGuard

100/100

Welcome back to trustworthy journalism.

Find out more

Why this story matters

Sensitive ATF investigative files, including phone records, forensic data and names of persons of interest in criminal cases, have been publicly posted online after a ransomware attack on a federal law enforcement system.

Criminal case data is now public

Names of persons of interest in federal criminal investigations, along with extracted phone data and IP addresses, are reportedly downloadable on a dark web leak site.

ATF cannot confirm scope

The ATF said it cannot confirm the authenticity, nature or scope of the leaked material, leaving the full extent of the exposure unverified as of its statement.

Federal investigation is underway

The ATF, Department of Justice and other federal agencies have opened a review, meaning details about what was compromised remain officially undisclosed.

Straight Arrow
Fear No Fact.

Don't just take our word for it.


Center-rated reporting

According to media bias experts at AllSides

AllSides Center-rated reporting May 2026

Transparent and credible

Awarded a perfect reliability rating from NewsGuard

100/100

Welcome back to trustworthy journalism.

Find out more