news
Cybernews Says the 6.3GB Cache Exposed Investigation Targets, Phone Records, iCloud Data, and Cellebrite Extractions
A ransomware gang dumped what appears to be 6.3GB of ATF surveillance and investigative files after the federal gun agency suffered a cyberattack that Justice Department officials designated a “major incident.”
The Russian-speaking Qilin group published the files after a 72-hour countdown, according to a Cybernews investigation. Researchers said the cache appeared to expose investigation targets, phone numbers, IP addresses, account identifiers, iCloud records, SIM-card data, and Cellebrite phone extractions.
Gun Owners of America publicized the breach, warning that the leaked material included names and digital evidence connected to criminal investigations.
ATF confirmed the cyberattack and said it severed connections to the compromised environment. The agency later identified the target as its standalone CALEA system, which supports federally authorized electronic surveillance.
The Record reported that the system contained information about targets of ATF investigations. ATF said the breach did not reach its enterprise network, case-management systems, laboratories, or eForms platform.
The bureau said it could not yet confirm the authenticity or full scope of Qilin’s published cache. Cybernews, however, reported reviewing folders labeled for ATF field offices and individual investigations.
An agency that stockpiles Americans’ most sensitive communications and device data failed to keep intruders out of the vault.
