US ATF system holding investigation targets breached; Qilin publishes alleged case files

According to The Record, the US Justice Department's ATF appeared on the Qilin ransomware gang's leak site, and a spokesperson confirmed the incident involved a standalone computer system containing information about targets of ATF investigations, designated a "major incident" under federal guidelines ^[1]. According to Cybernews, after Qilin's 72-hour countdown expired it published alleged ATF case files, phone dumps and forensic evidence that could expose witnesses, informants and officers ^[2]. Agencies can follow ATF's approach of immediately cutting connections to the affected environment and starting incident response and forensics on detection ^[1].

Industries mainly affected: Government

1. On detecting an intrusion, cut connections to the affected environment and start incident response and forensics ^[1].
2. Isolate systems holding sensitive investigative data from other systems ^[1].