WASHINGTON — On September 24, eight U.S. Senators wrote to Attorney General Todd Blanche disclosing that the Bureau of Alcohol, Tobacco, Firearms and Explosives holds more than 1.4 billion gun-related records, comprising a de facto, illegal database. The revelation comes amidst the recent news of successful cyberattacks on the ATF, the Pentagon, and the FBI, begging the question about just how safe gun owners’ private information is in the hands of the government.
The joint letter from Senators Jim Risch (R-Idaho), Mike Crapo (R-Idaho), Marsha Blackburn (R-Tenn.), Ted Budd (R-N.C.), Tom Cotton (R-Ark.), Steve Daines (R-Mont.), Cindy Hyde-Smith (R-Miss.), and Pete Ricketts (R-Neb.) notes that the ATF database comprises an “illegal gun registry” forbidden by federal law.
The collective records were obtained from out-of-business firearms dealers and include names, addresses, Social Security numbers, and the specific firearms purchased. The 1.4 billion figure came from a June 10 written response to Rep. Cloud from the DOJ’s Office of Public and Governmental Affairs.
As recently as May, ATF Director Robert Cekada confirmed over 1.38 billion pages of out-of-business records during testimony, suggesting that either the ATF under-reported the initial figure or added nearly 30 million records to the database between the two reports. According to the ATF’s own data, 881 FFLs surrendered their license or went out of business in FY 2025.
The controversy over the now well-known database, including the increasing risk to the privacy of gun owners, surged significantly when cyberattacks on three different government agencies were revealed in just the last couple of weeks.
On August 26, the ATF acknowledged a cyberattack against its CALEA system that it designated as a “major incident.” The attack resulted in the leaking of information by the Russian-speaking Qilin ransomware group, which published more than 6 GB of data it claimed was taken from the ATF, including investigation-related material such as names, phone numbers, IP addresses, and phone/forensic dumps.
On September 23, the FBI stated it was aware of a cyberattack (attributed to a cybercriminal group called ShinyHunters) that was later reported to result in leaks of “sensitive information about employees,” including “sensitive information concerning nearly all FBI agents, as well as people who applied for FBI jobs.”
On September 28, it was revealed that the Pentagon was subject to a data breach in which sensitive data was exposed for nearly 3 million people. The personally identifiable information stolen from the personnel database included Social Security numbers and job details. One report stated, “The scope and sensitivity of the exposed information could raise national security concerns, particularly because the files included details about the jobs performed by military and civilian personnel.”
Information collected as the result of a sale of a firearm (usually via Form 4473), and now held by the ATF, is far more comprehensive, with a much greater potential for abuse, including full name, sex, residence, height, weight, race, country of citizenship, state of residence, copy of government-issued ID, and Social Security number.
Gun rights groups have noted for years that the ATF database is illegal and have increased the urgency in their calls for its destruction, with Gun Owners of America stating, “We need the registry to be dismantled and these records deleted before a future administration uses them for gun confiscation.”
This publication has documented how bad actors in a future, hostile administration could engineer the use of such a registry against gun owners, in detail.
