Two suspects in Perth charged over TeamPCP cyberattacks on major tech firms
Australian Federal Police arrested two individuals in Perth linked to the TeamPCP hacking group, which compromised open source projects and stole credentials. The suspects face charges including hacking, money laundering, and extortion, with over a thousand organizations reportedly affected. The group's attacks targeted companies like Mercor and OpenAI, and also breached the European Commission's cloud infrastructure.
The arrests stem from an investigation launched in April 2026, following tips from multiple cybersecurity firms. Authorities seized stolen data, devices, and electronics, and plan to notify affected victims. The suspects allegedly tampered with open-source tools to distribute malicious code, stealing over 500,000 credentials for further intrusions. One suspect, reportedly Ruben Thomson (handle "Ellis"), claimed to have led TeamPCP until March 2026, according to journalist Brian Krebs, who linked him to the group through operational mistakes. The charges include hacking, money laundering, and extortion, with more than a thousand organizations reportedly compromised.
This case could reshape how software supply-chain risks are perceived, especially for companies relying on open-source dependencies. If extortion and credential theft become more common, smaller firms may face heightened pressure to audit their tools, while larger tech giants might tighten vetting of third-party code. The arrests may also deter some hackers, though the global nature of such groups suggests limited long-term impact without broader international cooperation. Affected organizations could see increased scrutiny of their security practices, and individuals whose credentials were stolen may face identity or data misuse.