NRA finally admits it was hacked by a ransomware group in 2021

The National Rifle Association (NRA) has just said for the very first time that, yes, the organization was indeed treaded on when it became victim of a massive hack last year.

The right wing organization best known for fighting common sense gun control measures after school shootings like the ones at Sandy Hook and Stoneman Douglas — and also acting as a "foreign asset" to Russia –– confirmed the ransomware attack in a Federal Election Commission filing made by the NRA's political action committee (PAC).

The NRA finally admitted to the attack it suffered in the filing because it needed to explain discrepancies in its financial reports previously submitted to the government. The filing says that around $2,485 in contributions to the organization hadn't been “processed correctly." The NRA blamed the hack for the disparity. 

In October 2021, a ransomware group known as Grief targeted the NRA and boasted about the data it had stolen from the gun organization. Grief, which has ties to the Russia-based cybercriminal ring Evil Corp., allegedly stole tax, grant, and investor information from the NRA and posted the stolen information on its website. Grief later released more sensitive personal and financial data, such as bank accounts numbers.

At the time, the NRA would not confirm or deny the hack, releasing a statement that claimed that the "NRA takes extraordinary measures to protect information regarding its members, donors, and operations – and is vigilant in doing so."

We now know they weren't quite vigilant enough. Grief's ransomware campaign attacked the NRA on Oct.20 and the gun group felt the effects well into November. The NRA's internet access, emails, and online networks were subject to varied levels of downtime for weeks.

It's unclear if the NRA ever paid a ransom to Grief in order to avoid the further release of any other stolen data.

Ransomware hacks can be detrimental to an organization. Businesses have shut down after suffering losses from such attacks. It's too bad this wasn't one of those cases.