Qilin Ransomware Publishes 6.3GB of ATF Investigation Files After Missed 72-Hour Ransom Deadline
Qilin published ~6.3GB of stolen ATF data after the Bureau of Alcohol, Tobacco, Firearms and Explosives missed a 72-hour ransom deadline, including open-case records and mobile-device extractions.
Qilin published ~6.3GB of data stolen from ATF systems on its leak site after the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) missed a 72-hour ransom payment deadline. The dump includes records of open investigations into armed robbery, arson, and homicide, plus mobile-device forensic extractions of involved parties.
Overview
The affected asset is a standalone ATF system related to CALEA communications-intercept functions. ATF said the system was architecturally isolated from the case-management and lab systems and was shut down after the intrusion was found. Isolation did not stop attackers from obtaining high-value data—Qilin published the full steal after ransom talks collapsed, following the double-extortion playbook.
Technical details
Available information indicates attackers obtained a complete data copy from that standalone system, implying long dwell time or thorough privilege collection. Two items in the leak are especially concerning: open-investigation case records, which may expose investigative direction, involved parties, and chain-of-evidence details; and mobile forensic extractions, which typically include contacts, call logs, and messages, potentially endangering informants and investigators and obstructing ongoing proceedings.
Impact
- Leak size: ~6.3GB, including open-case records and phone forensic data.
- Distinguishing factor: LEA data leaks are uncommon in the ransomware ecosystem; impact goes beyond the data itself and can undermine ongoing investigations.
- Trend: Qilin is among the most active ransomware crews; this incident matches its high-tempo attacks across multiple sectors.
Remediation
- Isolated and offline systems are not safety islands: they still need patch management, MFA, and login monitoring. Attackers often reach these dead corners via credential reuse.
- Minimize retention of forensic and classified data; purge expired data completely to shrink blast radius of a single leak.
- Segment the network and baseline egress traffic; anomalous outbound from an isolated system should fire a high-priority alert.
- Offline backups plus regular restore drills remain the last effective fallback in ransomware scenarios.
Sources
- Cybersecurity Journal: Daily Brief 2026-09-07
- Secret CISO: Qilin Ransomware Leaks ATF Investigation Files