ATF Responds to Cybersecurity Incident Affecting Standalone System

Summary

ATF says a cybersecurity incident affected a standalone system, with no indication of impact to its enterprise network or other systems. The agency disconnected the environment and began incident-response and forensic work.

Key points

• The incident affected an ATF standalone system, separate from the agency’s enterprise network.
• ATF said there was no indication the incident affected its enterprise network, eForms system, or any other ATF system.
• ATF terminated connections to the affected environment and began incident-response and forensic activities.
• The agency is coordinating with the Department of Justice to investigate.
• Senior Department officials designated the event a major incident under federal guidelines; required notifications were completed.
• ATF reported that the incident has not affected its ability to perform its missions.