2021 National Rifle Association ransomware attack

On October 27, 2021, a Russian hacker group known as Grief published 13 documents attributed to the National Rifle Association of America (NRA) in a ransomware scam, claimed to have hacked the organization, and threatened to release more NRA documents if the undisclosed ransom was not paid.

Background

On October 21, 2021, the Federal Bureau of Investigation hacked and shut down REvil, a major hacking organization involved in ransomware scams. In response, other ransomware groups shared anti-United States messages on the dark web.

Prior to the ransomware attack, the National Rifle Association had been involved in multiple legal disputes, which Recorded Future analyst Allan Liska argued may have made them an easier target for cyberattacks as attention within the organization was pulled away from their security.

Ransomware attack

Initial release of documents

On October 27, 2021, Grief published 13 documents on their website as part of a ransomware scam, attributing them as internal documents belonging to the NRA and claiming to have hacked the organization. As reported in Wired, the hack likely took place within the week prior to the release of documents. The group threatened to release more files if the ransom (an undisclosed amount of money) was not paid.

An anonymous person with direct knowledge of the events at the NRA told Associated Press that the group had been having issues with its email system in the week prior to the publication of files by Grief, which is a potential indicator of a ransomware attack. On October 28, The Register reported that it was unknown whether the hack had targeted the headquarters of the NRA or one of its local branches.

The leaked files included the minutes from an NRA board meeting that occurred shortly before the release of documents as well as multiple files related to grants.