Hack-for-hire operations allegations: US lawmakers urge Lutnick to sanction 3 Indian tech firms
The lawmakers alleged that the operations have affected thousands of Americans and US companies, including private-equity and pharmaceutical firms and more than 1,000 lawyers associated with major US law firms.
- Sep 11, 2026,
- Updated Sep 11, 2026 11:30 AM IST
Three US lawmakers have urged the Trump administration to take action against three India-based technology companies accused of operating hack-for-hire operations and conducting targeted cyber espionage against Americans, US businesses and lawyers.
Democratic Senators Ron Wyden and Sheldon Whitehouse, along with Republican Representative Pat Harrigan, have asked Commerce Secretary Howard Lutnick to add BellTroX, CyberRoot and Sunkissed Organic Farms Pvt Ltd, formerly known as Appin Technology Pvt Ltd, to the US Commerce Department's Entity List.
The lawmakers made the request in a letter to Lutnick, arguing that India-based cyber-mercenary groups have spent more than 15 years conducting targeted espionage campaigns. They alleged that the operations have affected thousands of Americans and US companies, including private-equity and pharmaceutical firms and more than 1,000 lawyers associated with major US law firms.
The senators highlighted findings from Reuters and The Citizen Lab exposing widespread cyberattacks that hit private equity firms, pharmaceutical companies, and over 1,000 attorneys across major US law firms.
What are the allegations?
The lawmakers' concerns centre on what they describe as a global hack-for-hire industry, in which commercial cyber groups allegedly conduct hacking and surveillance operations on behalf of clients.
According to the letter, the three companies have been linked to campaigns aimed at obtaining sensitive information from individuals and organisations. The alleged targets included business executives, lawyers and companies involved in commercial or legal disputes.
The lawmakers also pointed to investigations that they say documented hacking campaigns against US interests. They alleged that stolen information could be used to influence or gain an advantage in ongoing litigation.
The letter further alleges that some of the groups had operated at the behest of foreign clients, including in connection with efforts involving Qatar's World Cup bid and the targeting of individuals associated with US political and intelligence circles.
Why the Entity List matters
The lawmakers are not simply seeking a criminal investigation. They want the three companies placed on the Commerce Department's Entity List, a powerful US export-control mechanism.
Being added to the list can restrict a company from obtaining US-origin goods, software and technology without a licence. In this case, the lawmakers specifically argued that the restrictions could cut the firms' access to American software, cloud infrastructure and cybersecurity tools.
Such a move could therefore have consequences beyond traditional sanctions, potentially affecting the technology infrastructure available to the companies.
Importantly, the request from Congress does not itself place the companies on the Entity List. The decision rests with the Commerce Department and its Bureau of Industry and Security.
Censorship allegations add another layer
The lawmakers also raised concerns about attempts to suppress reporting on the alleged hacking activities.
They accused the companies and their associates of using legal proceedings in foreign jurisdictions to challenge or remove investigative reports concerning their operations. According to the lawmakers, such efforts amounted to an aggressive campaign to limit public scrutiny of cyber-mercenary activities.
The letter also cited legal disputes involving US technology and media companies, including Google, Meta, Microsoft and The New Yorker.
These allegations have turned the issue into more than a conventional cybersecurity dispute, bringing together concerns over espionage, commercial hacking, access to technology and press freedom.
Indian companies have denied wrongdoing
The allegations remain allegations, and the companies have denied wrongdoing. The firms have rejected accusations of illegal activity, while legal disputes concerning reporting and the companies' activities remain ongoing.
The issue now moves to the US Commerce Department, which will have to decide whether the evidence warrants adding the companies and their subsidiaries to the Entity List.
What happens next?
The congressional request comes at a sensitive time for US-India technology and trade relations. Washington and New Delhi have been seeking deeper cooperation in areas such as semiconductors, artificial intelligence, telecommunications and advanced technology, while bilateral trade negotiations have also remained an important priority.
The proposed action against three India-based firms is narrowly focused on alleged cyber activity rather than India's wider technology sector. Still, placing the companies on the Entity List would represent a significant US enforcement action against Indian entities.
For the companies involved, the immediate question is whether Commerce Secretary Lutnick and the Bureau of Industry and Security will accept the lawmakers' recommendation. If they do, restrictions on access to US technology could substantially raise the operational costs and technological constraints facing the targeted firms.
Three US lawmakers have urged the Trump administration to take action against three India-based technology companies accused of operating hack-for-hire operations and conducting targeted cyber espionage against Americans, US businesses and lawyers.
Democratic Senators Ron Wyden and Sheldon Whitehouse, along with Republican Representative Pat Harrigan, have asked Commerce Secretary Howard Lutnick to add BellTroX, CyberRoot and Sunkissed Organic Farms Pvt Ltd, formerly known as Appin Technology Pvt Ltd, to the US Commerce Department's Entity List.
The lawmakers made the request in a letter to Lutnick, arguing that India-based cyber-mercenary groups have spent more than 15 years conducting targeted espionage campaigns. They alleged that the operations have affected thousands of Americans and US companies, including private-equity and pharmaceutical firms and more than 1,000 lawyers associated with major US law firms.
The senators highlighted findings from Reuters and The Citizen Lab exposing widespread cyberattacks that hit private equity firms, pharmaceutical companies, and over 1,000 attorneys across major US law firms.
What are the allegations?
The lawmakers' concerns centre on what they describe as a global hack-for-hire industry, in which commercial cyber groups allegedly conduct hacking and surveillance operations on behalf of clients.
According to the letter, the three companies have been linked to campaigns aimed at obtaining sensitive information from individuals and organisations. The alleged targets included business executives, lawyers and companies involved in commercial or legal disputes.
The lawmakers also pointed to investigations that they say documented hacking campaigns against US interests. They alleged that stolen information could be used to influence or gain an advantage in ongoing litigation.
The letter further alleges that some of the groups had operated at the behest of foreign clients, including in connection with efforts involving Qatar's World Cup bid and the targeting of individuals associated with US political and intelligence circles.
Why the Entity List matters
The lawmakers are not simply seeking a criminal investigation. They want the three companies placed on the Commerce Department's Entity List, a powerful US export-control mechanism.
Being added to the list can restrict a company from obtaining US-origin goods, software and technology without a licence. In this case, the lawmakers specifically argued that the restrictions could cut the firms' access to American software, cloud infrastructure and cybersecurity tools.
Such a move could therefore have consequences beyond traditional sanctions, potentially affecting the technology infrastructure available to the companies.
Importantly, the request from Congress does not itself place the companies on the Entity List. The decision rests with the Commerce Department and its Bureau of Industry and Security.
Censorship allegations add another layer
The lawmakers also raised concerns about attempts to suppress reporting on the alleged hacking activities.
They accused the companies and their associates of using legal proceedings in foreign jurisdictions to challenge or remove investigative reports concerning their operations. According to the lawmakers, such efforts amounted to an aggressive campaign to limit public scrutiny of cyber-mercenary activities.
The letter also cited legal disputes involving US technology and media companies, including Google, Meta, Microsoft and The New Yorker.
These allegations have turned the issue into more than a conventional cybersecurity dispute, bringing together concerns over espionage, commercial hacking, access to technology and press freedom.
Indian companies have denied wrongdoing
The allegations remain allegations, and the companies have denied wrongdoing. The firms have rejected accusations of illegal activity, while legal disputes concerning reporting and the companies' activities remain ongoing.
The issue now moves to the US Commerce Department, which will have to decide whether the evidence warrants adding the companies and their subsidiaries to the Entity List.
What happens next?
The congressional request comes at a sensitive time for US-India technology and trade relations. Washington and New Delhi have been seeking deeper cooperation in areas such as semiconductors, artificial intelligence, telecommunications and advanced technology, while bilateral trade negotiations have also remained an important priority.
The proposed action against three India-based firms is narrowly focused on alleged cyber activity rather than India's wider technology sector. Still, placing the companies on the Entity List would represent a significant US enforcement action against Indian entities.
For the companies involved, the immediate question is whether Commerce Secretary Lutnick and the Bureau of Industry and Security will accept the lawmakers' recommendation. If they do, restrictions on access to US technology could substantially raise the operational costs and technological constraints facing the targeted firms.