A Federal Law Enforcement Agency Just Got Hit by Ransomware, and a Single Phone Call Led to 284 Million Healthcare Records Walking Out the Door

Start with the story that should make every federal agency's security team a little uneasy: the Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed this week that one of its systems was compromised, hours after the Qilin ransomware gang added the ATF to its dark web leak site. Senior Department of Justice officials designated it a "major incident" under federal guidelines — the same classification tier that pulls in DOJ-level investigative resources rather than leaving an agency to handle a breach on its own. The ATF's own account draws a careful boundary: the compromised system was a standalone machine holding information about targets of ATF investigations, not connected to the agency's enterprise network, case management systems, laboratory systems, or eForms platform, and it was disconnected the moment the intrusion was discovered. Qilin, for its part, hasn't published any sample data or provided proof beyond adding the agency's name to its leak site — and the ATF has pointedly declined to confirm or deny that Qilin is actually responsible, a distinction worth sitting with given how often ransomware gangs claim credit for breaches they didn't cause, or inflate the scope of ones they did.

What makes this worth taking seriously regardless of attribution is simply what the system reportedly held: information on the targets of active ATF investigations. If Qilin's claim turns out to be accurate even in part, The Hill's own reporting captured the stakes plainly — the fallout from exposing that kind of data "could be enormous," touching ongoing criminal investigations rather than just administrative records. This is now one in a string of federal law enforcement incidents this year involving the U.S. Marshals Service and the FBI, a pattern that should reasonably concern anyone who assumes federal law enforcement infrastructure sits meaningfully outside the same threat landscape hitting the private sector. Comparitech's own tracking puts the broader picture in focus too: 799 ransomware incidents recorded last month alone, up from 668 in June, with Qilin personally responsible for 125 of them — making it one of the most prolific ransomware operations currently active, a volume that makes an ATF claim entirely plausible on pattern alone, even before anyone independently verifies it.

The same week carried a second Justice Department story that's easy to miss sitting next to the ATF headline, but shouldn't be. The DOJ announced it had seized two hacking platforms — tracked as QScan and QTrouter — operated by a state-run group tied to the Chinese firm Nanjing Xinjiuwei Network Technology Co. According to the DOJ's own announcement, these platforms had been used to target the DOJ itself, along with NASA, the Federal Reserve, and the Department of Energy. Set next to the ATF incident, the same week produced both a fresh ransomware claim against a federal agency and a law enforcement action disrupting nation-state infrastructure that had been probing some of the same government's most sensitive institutions — a reminder that "federal government under cyber pressure" isn't a single storyline with one villain, it's simultaneously a ransomware problem and a nation-state problem, running on parallel tracks that happen to share a target list.

The second story of the week is smaller in technical sophistication and larger in scale, and it's a clean illustration of exactly the lesson this site keeps returning to: the weakest point in a modern security stack is very often a phone call, not a firewall. ShinyHunters, the extortion group responsible for a long list of 2026's biggest breaches, claims it stole roughly 284 million patient-related data records from McKesson, one of the largest pharmaceutical and healthcare distribution companies in the United States. McKesson confirmed it discovered the incident on August 25 and disclosed it in an SEC filing, describing unauthorized access to third-party applications and data exfiltration, with the investigation still in its early stages. ShinyHunters told reporters it exfiltrated roughly a terabyte of data over four days, and — crucially — clarified that the 284 million figure counts individual data records, not unique patients; a single person can generate dozens of rows across appointments, prescriptions, and insurance claims, so the real number of affected individuals is meaningfully smaller, though McKesson hasn't confirmed what that number actually is.

The mechanism is the part worth studying closely, because it's now a recognizable, repeatable template rather than a one-off. ShinyHunters says it ran voice-phishing campaigns against multiple McKesson employees, talking them into handing over credentials or approving fraudulent access requests tied to the company's Okta single sign-on accounts. Once inside the SSO layer, the group pivoted into McKesson's Salesforce and Snowflake environments — the systems that reportedly held the bulk of the patient data — using nothing more exotic than a stolen, legitimate-looking identity. This is the same pattern ShinyHunters has run against other large organizations throughout the year; the group told BleepingComputer it breached the security firm ADT the same way, through a vishing call that compromised an employee's Okta account, though ADT's exposure in that case was limited to names, phone numbers, and addresses rather than anything close to McKesson's scale. The claimed McKesson data, by contrast, reportedly includes Social Security numbers, medical record numbers, medication and allergy details, diagnoses, information tied to deceased and terminally ill patients, physician and clinic data, and internal employee records — a breadth that reflects how much sensitive information flows through a distributor like McKesson on behalf of the hospitals, pharmacies, and insurers it services, meaning people who never had a direct relationship with the company at all could still show up in the exposed data.

ShinyHunters says it contacted McKesson after finishing the exfiltration and demanded a ransom of $55,236,150, with a 72-hour deadline, and that the company neither paid nor attempted to negotiate. Whatever you think of that specific number, the operational lesson underneath it is the one worth actually acting on: single sign-on is only as strong as the verification process behind approving a new device or access request, and a sufficiently convincing phone call routinely walks straight past technical controls that would stop a purely software-based attack cold. If your organization's Okta, Entra, or equivalent SSO deployment doesn't have a formal, hard-to-social-engineer process for verifying identity before granting new device trust or approving an access request — something more robust than "the caller knew the right internal jargon" — this is the second major breach in two months built on exactly that gap, and it won't be the last.

Two stories, one government agency and one private company, and the same underlying pattern showing up in both: the actual point of failure sits at the boundary between a system and the humans who operate or investigate it. The ATF's incident, whatever its true scope turns out to be, happened on a system holding information about the very people the agency investigates — a target list built by the work itself. McKesson's breach happened because a phone call was more convincing than the identity check standing behind it. Neither needed a novel exploit. Both needed patience and a plausible voice on the other end of the line.