A bipartisan group of US lawmakers has urged the US government to ban several 'hack-for-hire' firms, which are companies that carry out cyberattacks for paying clients. Democratic Senators Ron Wyden and Sheldon Whitehouse, along with Republican Congressman Pat Harrigan, sent a letter to US Secretary of Commerce Howard Lutnick on Wednesday, September 9, 2026.
The letter asks the Commerce Department to add three Indian companies—BellTroX, CyberRoot, and Sunkissed Organic Farms (previously Appin)—to its economic sanctions 'entity list'. This list restricts US businesses from transacting with named entities, aiming to limit their access to critical technology like software licenses and cloud infrastructure.
The lawmakers accuse these companies of conducting cyberattacks and targeted espionage against Americans, business owners, and their lawyers for over a decade, with the aim of manipulating ongoing litigation. They also allege that these mercenary hacking companies have stolen data from thousands of Americans and engaged in an "aggressive censorship campaign" to suppress public awareness of their activities.
The letter further states that the hack-for-hire companies "operated at the behest of the Qatari government" and that their targets included a former senior Republican lawmaker. Previous reporting has also linked Appin to Qatar in connection with cyberattacks against FIFA officials, reportedly to protect plans for the 2022 World Cup.
It is not yet clear if the Commerce Department will add the companies to its entity list.