Australian Police Arrest Two in TeamPCP Global Supply Chain Hack Case

The cybercrime group known as TeamPCP emerged as a significant threat by targeting the software supply chain. According to BleepingComputer and other outlets, the group specialized in planting malicious code within open-source software projects. This method allowed them to reach a wide range of organizations indirectly, as these compromised projects were integrated into the systems of major companies and services.

SecurityWeek reported that TeamPCP's campaign resulted in breaches of more than 1,000 organizations globally. Among the affected were high-profile technology firms, including OpenAI. The attacks often involved stealing login credentials through hidden malware, as noted by Security Affairs.

For months, Australian authorities worked to uncover those responsible, tracking activity that led back to Western Australia. The investigation highlighted the vulnerability of open-source software and the growing sophistication of cybercriminal syndicates.

On August 27, 2026, news broke that the Australian Federal Police had arrested two men in Perth in connection with TeamPCP. Outlets including BankInfoSecurity.com, iTnews, and Krebs on Security reported that the suspects were Ruben Ian Thomson, aged 21, and Louis Michael Gaebler, aged 23. They were described as principal participants in the hacking group.

According to Help Net Security, the men allegedly inserted malicious code into open-source software, enabling them to compromise organizations worldwide. BleepingComputer detailed that the attacks involved stealing credentials and sensitive data from victims. The malware campaign reportedly netted over 500,000 login credentials, according to Security Affairs.

Australian police conducted searches in several Perth suburbs as part of their investigation, as reported by The Record by Recorded Future. The operation was extensive and also involved cooperation with international law enforcement agencies, including the FBI, The Register noted.

The group's activities included the use of the Shai-Hulud worm, a piece of malware that spread through open-source repositories. TechCrunch highlighted that the affected targets included major tech companies like OpenAI and Mercor. The arrests came after months of what Cyberscoop described as "software supply-chain chaos" linked to TeamPCP's operations.

As of August 28, 2026, the two men face multiple charges related to hacking, credential theft, and money laundering. Australian authorities have not yet detailed all the charges, but outlets agree the case is one of the most significant recent cybercrime crackdowns in the country.

Investigations continue, with law enforcement focusing on the full scope of TeamPCP's activities and potential further arrests. The story has raised alarm about the security of open-source software and the global risks posed by supply chain attacks.

The next steps include court proceedings for the two accused men and possible further revelations about TeamPCP's reach and collaborators. Authorities may also disclose more about how the group operated and whether additional members or victims will be identified.