US Senators demand action against three India-based firms over data 'theft'

A bipartisan group of U.S. Senators have written to the Trump administration seeking action against three India-based companies that allegedly hacked and stole data from thousands of Americans and U.S. companies.

Democratic Senators Ron Wyden and Sheldon Whitehouse, and Republican Pat Harrigan, have urged Commerce Secretary Howard Lutnick to take action against Sunkissed Organic Pvt Ltd, BellTrox Ltd, and CyberRoot Ltd, contending that they hacked and stole data from thousands of Americans and U.S. companies.

“Several India-based cyber-mercenary groups have spent more than 15 years conducting targeted espionage against US citizens, businesses and the lawyers representing them,” Wyden, Harrigan and Whitehouse wrote to Lutnick.

According to investigations by Reuters and The Citizen Lab, these companies conducted widespread hacking campaigns targeting private equity firms, pharmaceutical companies, and more than 1,000 attorneys across major US law firms to manipulate ongoing litigation, the Senators said.

There is evidence that these groups operated at the behest of the Qatari government, targeting opponents of Qatar’s World Cup bid and the family of a former Republican chairman of the House Permanent Select Committee on Intelligence, they said.

“Compounding this security threat, these cyber mercenaries and their associates have engaged in an aggressive campaign of global lawfare to censor investigative reporting by prominent American media organisations,” the Senators said.

“This coordinated effort effectively allows foreign entities to use foreign courts to keep the American public in the dark about cyber threats to their own country and undermines the fundamental constitutional rights of US citizens,” they said.

These same companies also attempted to censor reporting about their hacking campaigns by abusing foreign courts – at one point forcing a global takedown of the investigation, the Senators alleged.

The Indian companies have ongoing lawsuits against US technology and media companies, including Google, Meta, Microsoft and The New Yorker, to silence criticism and bury facts about their illegal hacking campaigns, they said.

The members called on the Commerce Department’s Bureau of Industry and Security to add the three companies to the Entity List to cut off their access to American software, Cloud infrastructure, and cybersecurity tools.