Key facts
- Two men were arrested in Australia and charged in connection with the TeamPCP hacking group.
- TeamPCP allegedly compromised over 1,000 organizations globally by inserting malicious code into open-source software.
- The hackers are accused of stealing more than 500,000 credentials and 300 gigabytes of data.
- The investigation involved the Australian Federal Police and the FBI, beginning in April 2026.
- Attacks impacted companies like Mercor and LiteLLM, and potentially affected cloud infrastructure of the European Commission, GitHub, and OpenAI.
Australian police have charged two men, identified as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, in connection with the TeamPCP hacking group. The group is accused of compromising over 1,000 organizations globally by inserting malicious code into widely used open-source software, leading to the theft of more than 500,000 credentials and 300 gigabytes of data. Some businesses were subsequently extorted.
The Australian Federal Police announced the charges, which include 14 offenses related to cybercrime. The investigation, a joint effort with the FBI, began in April 2026 after receiving information from cybersecurity threat assessment companies. The FBI noted that the attacks impacted companies like Mercor and LiteLLM, and potentially affected the cloud infrastructure of the European Commission, GitHub, and OpenAI.
Austin Larsen, a threat analyst with Google Threat Intelligence Group, described TeamPCP as a significant threat actor in 2026, characterized by a community of skilled individuals rather than a single unified group. During the arrests in Perth, authorities seized a substantial amount of allegedly stolen data, along with electronic devices.