US Lawmakers Target Hack-for-Hire Firms: The Cyber-Espionage Risk to High-Stakes Litigation

A bipartisan group of US lawmakers has called on the Department of Commerce to take action against three India-based companies accused of conducting mercenary hacking campaigns against Americans, US businesses and the lawyers representing them.

On September 9, 2026, Senators Ron Wyden and Sheldon Whitehouse and Representative Pat Harrigan asked Commerce Secretary Howard Lutnick to consider adding the companies to the Entity List, which could restrict their access to US software, cloud infrastructure and cybersecurity technology.

According to the lawmakers, investigations by Reuters and Citizen Lab linked the companies to targeted cyber-espionage campaigns involving thousands of Americans and US businesses.

Particularly significant for the legal sector is the allegation that more than 1,000 attorneys at major US law firms were targeted as part of efforts intended to influence ongoing litigation.

The allegations highlight a serious but sometimes overlooked litigation risk: parties to commercial disputes may face attempts to obtain confidential information through cyber intrusion rather than through the legal process.

What Are Hack-for-Hire Operations?

Hack-for-hire activity involves individuals or organizations carrying out cyber intrusions on behalf of clients.

The objective can vary.

Targets may include:

• Corporate executives.
• Lawyers.
• Litigation opponents.
• Journalists.
• Investors.
• Political figures.
• Competitors.
• Individuals involved in commercial disputes.

Rather than attempting to steal money directly, an attacker may seek confidential communications, legal strategy, commercial information or evidence that could provide an advantage to another party.

This makes hack-for-hire activity particularly relevant in high-value litigation and contentious commercial matters.

Why Law Firms Are Attractive Targets

Law firms hold some of the most commercially sensitive information within an organization’s wider professional network.

Their systems may contain:

• Legal strategy.
• Settlement positions.
• Witness information.
• Privileged communications.
• Internal investigations.
• Due diligence material.
• Financial records.
• Evidence obtained during litigation.
• Confidential corporate information.

Obtaining access to that material could provide significant insight into an opponent’s position.

In some circumstances, attackers may not need access to the client organization itself if they can instead compromise an external law firm, consultant or other professional adviser.

This creates a wider security challenge.

Cyber risk in litigation is not limited to the security of one company. It can extend across the network of people and organizations involved in the matter.

The Allegations Raised by US Lawmakers

The September 9 congressional letter identified three India-based companies:

• Sunkissed Organic Farms Pvt. Ltd., formerly known as Appin Technology Pvt. Ltd., and associated entities.
• BellTroX Pvt. Ltd.
• CyberRoot Pvt. Ltd.

The lawmakers cited reporting and research linking these organizations to hacking campaigns against private-equity firms, pharmaceutical companies and lawyers.

They alleged that the activity was used in attempts to manipulate ongoing litigation and described the operations as targeted espionage against US citizens, businesses and legal representatives.

TechCrunch separately reported that the lawmakers accused the companies of stealing data from thousands of Americans and engaging in campaigns designed to suppress reporting about the alleged activity.

These remain allegations and should be treated as such unless established through the relevant legal or regulatory processes.

Cyber-Espionage Can Affect the Balance of a Legal Dispute

Traditional litigation risk focuses on issues such as disclosure, witness evidence, legal arguments and the preservation of documents.

Cyber-espionage introduces another dimension.

If a hostile party obtains confidential information outside the formal legal process, it could potentially gain insight into:

• Litigation strategy.
• Weaknesses in a case.
• Settlement thresholds.
• Internal concerns.
• Witness evidence.
• Investigative findings.
• Commercial pressure points.

Even an unsuccessful intrusion attempt can indicate that a dispute has attracted attention from actors willing to use unlawful or covert methods.

This is why suspected cyber activity around a contentious matter should not necessarily be treated as an isolated IT incident.

It may form part of the wider litigation risk.

Warning Signs That May Require Investigation

No single event proves that a law firm or client is being targeted through a hack-for-hire operation.

However, certain indicators may justify closer examination, particularly during high-value or sensitive proceedings.

These can include:

• Unusual phishing attempts directed at legal teams.
• Repeated password reset requests.
• Suspicious login attempts.
• Impersonation of colleagues or advisers.
• Targeted social-engineering activity.
• Unexpected requests for confidential documents.
• Compromise of personal email accounts.
• Attempts to obtain information through third parties.
• Suspicious activity affecting several individuals involved in the same dispute.

The important issue is context.

A generic phishing email may be routine cybercrime.

A coordinated campaign directed at several people connected to the same litigation may require a different level of scrutiny.

Establishing What Happened

Where a compromise is suspected, an investigation should be evidence-led.

The immediate objective is to determine:

• Which accounts or systems may have been targeted.
• Whether unauthorized access occurred.
• What information may have been accessed.
• How the attacker obtained entry.
• Whether other individuals or organizations were targeted.
• Whether there are links between the cyber activity and the underlying dispute.

Preserving logs, devices, email records and other digital evidence can be important.

Conflict International USA’s Cyber Security capabilities can support organizations where suspected intrusion, unauthorized access or data compromise requires examination.

Why Litigation Support and Cyber Security Increasingly Overlap

Cyber incidents involving litigation cannot always be resolved through technical remediation alone.

If a compromise relates to an active dispute, legal teams may also need to understand the wider context.

Questions can include:

• Who may benefit from the information?
• Were particular individuals targeted because of their role in the case?
• Does the timing coincide with an important stage of proceedings?
• Were external advisers also targeted?
• Is there evidence of coordinated activity?
• Could the incident affect disclosure, evidence or litigation strategy?

This is where cyber investigation and litigation support can intersect.

Conflict International USA’s Litigation Support services can assist legal teams and organizations with fact-finding, evidence development and investigative support in complex disputes.

Third Parties Can Be a Vulnerability

The security of a litigation matter depends on more than the client and its law firm.

Other parties may hold sensitive information, including:

• Expert witnesses.
• Investigators.
• Accountants.
• Consultants.
• Data-room providers.
• Public relations advisers.
• Litigation funders.
• External technology providers.

An attacker may target whichever organization appears to offer the easiest route to the desired information.

Legal teams should therefore consider the wider information environment surrounding a dispute.

This does not mean every service provider requires the same level of scrutiny.

The level of protection should reflect the sensitivity of the information each party holds.

Protecting Confidential Litigation Information

Organizations involved in sensitive disputes should consider whether existing cyber controls are appropriate for the circumstances.

Measures may include:

• Multi-factor authentication.
• Strong access controls.
• Segregation of particularly sensitive matter files.
• Secure document-sharing systems.
• Monitoring for unusual login activity.
• Verification of unexpected communication requests.
• Restrictions on personal email use.
• Awareness training for individuals involved in high-risk matters.
• Clear incident-response procedures.

Where there is evidence that a particular person or organization is being deliberately targeted, additional protective measures may be appropriate.

Evidence Preservation Can Be Critical

If unauthorized access is suspected, immediate containment is important, but so is preserving evidence.

Deleting suspicious messages or resetting systems without retaining relevant records can make it more difficult to establish what happened later.

Potential evidence may include:

• Email headers.
• Login records.
• IP information.
• Device logs.
• Messaging records.
• File-access histories.
• Suspicious domains.
• Phishing messages.
• Malware samples.

The appropriate response will depend on the circumstances, but early preservation can help establish a clearer chronology.

A Wider Risk for High-Stakes Commercial Disputes

The latest congressional action demonstrates that hack-for-hire activity is no longer a theoretical concern for legal teams.

US lawmakers allege that sophisticated cyber-mercenary operations have targeted businesses and more than 1,000 attorneys in an effort to obtain information connected with ongoing litigation.

Whether a dispute involves corporate control, intellectual property, financial claims or another high-value commercial issue, confidential information can have significant strategic value.

Organizations therefore need to consider cyber security as part of the wider litigation-risk environment.

Protecting privileged and commercially sensitive information, recognizing targeted cyber activity and establishing the facts quickly when a compromise occurs can all be important in preventing a digital intrusion from affecting the course of a legal dispute.