Australia Arrests Two Men Accused of TeamPCP Supply-Chain Attacks

Summary

Australian authorities arrested and charged two men accused of TeamPCP ties. Police say the supply-chain campaign may have compromised more than 1,000 organizations; investigators seized devices, and the suspects face computer-related charges.

Key points

Two men, aged 21 and 23, were arrested in Western Australia on August 26, 2026, and charged over alleged links to TeamPCP.
Authorities say the alleged campaign injected malicious code into open-source software and developer platforms, which developers may have incorporated into their applications.
The AFP, FBI and Western Australia Police say the code may have affected more than 1,000 organizations and enabled theft of 500,000 credentials and exfiltration of at least 300 GB of data; these figures are authority claims, not independent confirmation.
The suspects face a combined 14 charges related to possessing or supplying data for computer offenses and modifying data to facilitate serious crimes.
The younger suspect also faces allegations involving at least $100,000 in criminal proceeds and failing to comply with an order to provide access to electronic data.
Investigators seized electronic devices and other evidence for forensic analysis; the AFP said further arrests or charges remain possible.

Article Details

Event Type: Australian authorities arrested and charged two men accused of involvement in TeamPCP supply-chain attacks.
Impact: Authorities say malicious code distributed in the alleged campaign may have compromised more than 1,000 organizations worldwide, enabled the theft of about 500,000 credentials and the exfiltration of at least 300 GB of data, and caused remediation costs estimated in the hundreds of millions of dollars. These figures are reported allegations or estimates.