Australian police arrest two accused of leading TeamPCP hacking spree

Australian police have arrested two people in Perth accused of being members of TeamPCP, a prolific hacking group blamed for high-profile breaches at big tech companies in recent months. The two have been charged with more than a dozen hacking, money laundering, and other cybercrime offenses and were expected in court Thursday.

According to a statement from the Australian Federal Police, the men are accused of widespread breaches involving the compromise and tampering of popular open source projects, aiming to infect large numbers of computers to steal credentials and data before extorting victims for ransom. The FBI’s cyber division chief, Brett Leatherman, said the two alleged TeamPCP members are accused of hacking into more than a thousand organizations as part of their campaign. It’s unclear whether the U.S. Justice Department plans to seek extradition, and the FBI did not respond to a request for comment.

TeamPCP is a prolific cybercriminal gang known for software-supply-chain attacks, in which hackers break into and maliciously modify a popular open source tool used by potentially thousands of companies. Once installed on a company’s or developer’s systems, the malicious code steals private keys and other credentials used to access cloud storage and, often, customer data. Authorities said the hackers stole more than half a million credentials to further their attacks on other companies.

The group has been blamed for a cyberattack on the vulnerability-scanner tool Trivy, which affected companies relying on it, including LiteLLM and AI recruiting startup Mercor, among others. The hackers are also suspected of breaching the European Commission’s cloud infrastructure and of targeting other open source projects and developer apps that provided access to tech giants including GitHub and OpenAI. Australian officials said their investigation began in April 2026 after tips from multiple cybersecurity companies.

The arrested men haven’t been named by police, but independent cybersecurity journalist Brian Krebs reported that one of them is Ruben Thomson, who goes by the hacker handle Ellis. Krebs said he had been in contact with Ellis over the past several months, and that the hacker told him he led TeamPCP until March 2026. According to Krebs, Ellis made mistakes that let the journalist uncover his real identity.

During a press conference announcing the arrests, Australian officials said they had also seized a large quantity of allegedly stolen data along with devices and other electronics, and that they plan to notify victims of the attacks.

Why it matters

TeamPCP’s alleged method — tampering with widely used open source tools to reach thousands of downstream companies at once — is a reminder that a single compromised dependency can cascade into breaches at AI labs, recruiting platforms, and government cloud systems alike. Arrests don’t guarantee the technique disappears; other groups can copy a supply-chain playbook once it’s proven to work.