US senators urge Trump administration to act against 3 India-based cyber firms over data theft allegations

A bipartisan group of US senators has urged the Trump administration to take action against three India-based companies accused of hacking and stealing data belonging to thousands of Americans and US businesses.

Democratic Senators Ron Wyden and Sheldon Whitehouse, along with Republican Senator Pat Harrigan, have asked Commerce Secretary Howard Lutnick to take action against Sunkissed Organic Pvt Ltd, BellTrox Ltd and CyberRoot Ltd for their alleged involvement in hacking operations.

"Several India-based cyber-mercenary groups have spent more than 15 years conducting targeted espionage against US citizens, businesses and the lawyers representing them," Wyden, Harrigan and Whitehouse wrote to Lutnick.

Companies accused of targeting US businesses, lawyers

The senators cited investigations by Reuters and The Citizen Lab, which they said uncovered widespread hacking campaigns targeting private equity firms, pharmaceutical companies and more than 1,000 attorneys working at major US law firms.

According to the lawmakers, the alleged operations were aimed at obtaining sensitive information that could potentially be used to influence or manipulate ongoing litigation in the United States.

The senators also said there was evidence that the groups operated at the direction of the Qatari government. Their alleged targets included individuals opposed to Qatar's bid to host the World Cup, as well as members of the family of a former Republican chairman of the House Permanent Select Committee on Intelligence.

"Compounding this security threat, these cyber mercenaries and their associates have engaged in an aggressive campaign of global lawfare to censor investigative reporting by prominent American media organisations," the Senators said.

"This coordinated effort effectively allows foreign entities to use foreign courts to keep the American public in the dark about cyber threats to their own country and undermines the fundamental constitutional rights of US citizens," they said.

Alleged efforts to suppress reporting

The lawmakers further accused the three companies of attempting to suppress media coverage of their alleged hacking activities by using foreign courts.

At one point, they allegedly succeeded in obtaining a global takedown of an investigation into the hacking campaigns, the senators said.

The companies are also involved in ongoing legal disputes with US technology and media organisations, including Google, Meta, Microsoft and The New Yorker. According to the senators, these lawsuits are being used to silence criticism and prevent information about the alleged hacking operations from coming to light.

Senators seek Entity List action

The bipartisan group has called on the Commerce Department's Bureau of Industry and Security to place Sunkissed Organic, BellTrox and CyberRoot on the US Entity List.

Such a move could restrict the companies' access to American technology, including software, cloud infrastructure and cybersecurity tools.

The senators argued that placing the firms on the list would help limit their ability to conduct further cyber operations targeting Americans and US companies.