Overview
- The bipartisan request was delivered to Commerce Secretary Howard Lutnick on Wednesday, September 9, 2026, asking that Sunkissed Organic Farms (formerly Appin), BellTroX and CyberRoot be added to the Bureau of Industry and Security’s Entity List.
- Lawmakers say the firms have spent more than a decade conducting targeted intrusions and stealing data from thousands of Americans, businesses and lawyers to influence litigation and business outcomes.
- The Entity List would bar U.S. companies from supplying listed entities with software, cloud services and cybersecurity tools, a noncriminal administrative step meant to limit their technical capabilities.
- The letter cites investigative reporting and prior enforcement actions, notes at least one operative was indicted by the Justice Department, and alleges the groups used foreign courts and lawsuits to suppress media coverage.
- If Commerce acts, the move could curb the firms’ access to key U.S. infrastructure and raise pressure for broader policy responses to the global hack-for-hire industry, while the department and the named companies have not publicly responded.