The ATF is the latest federal government agency in recent years to notify Congress of a "major incident" involving its cybersecurity.

The arrests come after a wave of cyberattacks earlier this year targeting tech companies that rely on high-profile and widely used open source software.