The Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed last week that attackers breached a system holding records on people previously investigated by the agency. That network was separate from other operational systems, including those used for firearm purchase records, and the agency said the incident did not hinder its work.

On Monday a likely Russian-speaking ransomware group known as Qilin posted files it claimed came from the breach. Reviews by CNN and researcher Ron Fabela found material on past investigation targets, analyses of phone communications, named agents, and prominent cases involving armed robbery, arson, explosives, and homicide, with many linked to the Houston Field Division. ATF has not confirmed Qilin as the culprit and said it cannot yet verify whether the posted material is genuine, what it contains, or how far it extends, while it coordinates with the Justice Department and other federal agencies.