Russian Ransomware Gang Qilin Publishes Stolen ATF Investigation Files Including Wiretap Data

The Qilin ransomware gang, assessed with high confidence to be Russian-speaking by the cybersecurity firm Halcyon 1, posted roughly 6.3GB of files on its dark web leak site Monday after the ATF disclosed a "major" cyber incident and Congress was notified 2. ATF confirmed the breach struck a standalone server running its CALEA system, used for wiretaps and communications monitoring under federal electronic surveillance law, and said the compromised system was disconnected from case management, laboratory, and eForms systems 23. A review by CNN and independent researcher Ron Fabela found the leaked files include ATF investigation targets, phone-communications analyses, and cases tied to specific agents, concentrated in the Houston Field Division and covering armed robbery, arson, explosives, and homicide investigations 1. Cybernews researchers identified additional material including Cellebrite phone extractions, device and account identifiers, and files naming the Laredo Field Office and an "Armored Truck Robbery" case series, though ATF said it "cannot confirm the authenticity, nature, or scope" of the data 2. Qilin removed the leak-site links by September 1, but the files were accessible for most of Monday before removal 2.