ATF eForms breach exposes risks
A simple exploit in the ATF’s eForms system forced user bans after fraud and overload, highlighting how fragile public‑sector digital intake platforms can be under strain. The episode is a caution for transit agencies relying on online reporting and compliance tools — a single vulnerability can disrupt operations and audits. (ammoland.com)
A user-interface bypass in ATF’s eForms let applicants enter custom free-text where a dropdown was expected, a step‑by‑step exploit that circulated on Reddit and other forums triggered mass reuse before posts were removed and dozens of accounts were reportedly suspended. (ammoland.com) The eForms portal is operated under a DOJ/ATF managed‑IT arrangement with Leidos, and a DOJ OIG audit previously flagged ATF’s failure to enforce patching and performance KPIs for that contract as increasing cyber and availability risk. (leidos.com) Industry trackers reported an unprecedented surge—one outlet cited roughly 150,000 NFA submissions in a single day versus a historical daily average near 2,500—creating backlog and processing strain on the electronic intake platform. (usacarry.com) ATF’s eForms had already been taken offline for a planned Dec. 26, 2025–Jan. 1, 2026 blackout to implement rule and tax‑stamp changes, a scheduled disruption that industry sources say contributed to persistent draft losses and pent‑up demand entering 2026. (outdoorhub.com) Government contracting records show the IT relationship operates at scale—USAspending lists large awards to Leidos for DOJ work and the OIG cited ATF’s $492.7 million tasking and oversight shortfalls—highlighting how third‑party managed services can become single points of failure for agency compliance workflows. (usaspending.gov) Forum and trade reporting confirm immediate operational impacts: user suspensions, deleted drafts during blackout windows, and widespread applicant confusion while eForms remains the primary online path for submitting NFA Form filings. (ammoland.com)
