Australian Federal Police and FBI Arrest Two Members of TeamPCP Supply-Chain Group — 1,000 Organizations Compromised, 500,000 Credentials Stolen

Summary

The Australian Federal Police, working with the FBI and Western Australia Police Force, arrested and charged two men on August 26, 2026 who are alleged to be members of TeamPCP, a cybercrime group responsible for a series of developer supply chain attacks that police say compromised more than 1,000 organizations worldwide, enabled the theft of more than 500,000 credentials, and caused the exfiltration of at least 300 gigabytes of data. Remediation costs are estimated at hundreds of millions of dollars. Ruben Ian Thomson, 21, was arrested in Cottesloe, and Louis Michael Gaebler, 23, was arrested in Mandurah. The two men appeared in Perth Magistrates Court on August 27. They face a combined 14 charges including unauthorized modification of data, possessing and supplying data for use in computer offenses, failing to comply with law enforcement orders, and dealing with criminal proceeds worth $100,000 or more. TeamPCP carried out its attacks by injecting malicious code into open-source software packages hosted on public repositories. Developers who incorporated the affected packages into their own software unknowingly distributed the malicious code into their organizations' systems. High-profile attacks attributed to TeamPCP affected Trivy, LiteLLM, Telnyx, SAP, and TanStack packages. The group also breached the European Commission, Mistral AI, OpenAI, and GitHub. Parallel AFP and FBI investigations began in April 2026 after cybersecurity firms provided intelligence to law enforcement. Both Flare and independent security researcher Brian Krebs published separate investigations after the arrests linking the accused to online activity through reused aliases and overlapping infrastructure. Oligo Security traced TeamPCP's infrastructure back to 2020 activity previously tracked under different names.

Timeline

Domain Intelligence

Context

afp.gov.au scores 93.0 — one of the highest scores in The Trust Observatory's domain intelligence database, consistent with a federal law enforcement domain. The TeamPCP arrests represent the most significant law enforcement action against a developer supply chain threat actor group in 2026. The scale of impact — more than 1,000 organizations, 500,000 credentials, 300GB of exfiltrated data, hundreds of millions in remediation costs — from what police describe as the compromise of a small number of trusted software components illustrates the asymmetric leverage of supply chain attacks. Two individuals using open-source repository infrastructure achieved a global impact that would have required significantly greater resources through conventional intrusion methods. The arrests impose costs on the alleged actors but do not recover exfiltrated credentials, reverse the supply chain compromise, or guarantee that all affected organizations have identified their exposure.