Australian police arrest two men accused of widespread open-source software hacking
Sign up now: Get insights on Asia's fast-moving developments
The Australian men face a combined 14 charges for their alleged roles in TeamPCP, a hacking collective that inserted malicious code into popular tools to compromise businesses.
PHOTO: SCREENGRAB FROM AUSTRALIAN FEDERAL POLICE/FACEBOOK
- Australian police will charge two men over hacking open-source software used by thousands of businesses worldwide.
- The hackers inserted malicious code that stole over 500,000 credentials and 300 gigabytes of data, affecting more than 1,000 organisations globally.
- The investigation involved the FBI and cybersecurity firms, highlighting TeamPCP as a major cyber threat in 2026, described as a skilled collective rather than a unified group.
AI generated
SYDNEY – The Australian police announced charges on Aug 27 against two men accused of participating in a cybercrime syndicate that targeted widely used open-source software to compromise thousands of global businesses.
The Australian men face a combined 14 charges for their alleged roles in TeamPCP, a hacking collective that inserted malicious code into popular tools to compromise businesses, according to a statement from the Australian Federal Police. Some of the businesses were later extorted, according to a July Federal Bureau of Investigation (FBI) advisory.
The police did not name the men, but the Australian Broadcasting Corporation identified them as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23.
Nick Scerri, a lawyer for Thomson, did not immediately respond to a request for comment outside of normal business hours. Reuters could not immediately find an attorney for Gaebler.
The malicious code potentially compromised more than 1,000 organisations globally, enabling the theft of more than 500,000 credentials and more than 300 gigabytes of data, according to the police.
The police said they conducted a parallel investigation into the men with the FBI starting in April after receiving information from multiple unnamed cybersecurity threat assessment companies.
“We are proud to work with the Australian Federal Police and the Western Australia Police Force to impose cost on criminal actors and combat the growing threat of software supply-chain attacks,” FBI Cyber Division Assistant Director Brett Leatherman said in the police statement.
The FBI declined further comment.
Austin Larsen, a principal threat analyst with Google Threat Intelligence Group, called TeamPCP “one of the most impactful threat actors of 2026” in a message posted to LinkedIn. Larsen described TeamPCP as a “peer community of individually skilled actors with one clear centre of gravity”, rather than a single, unified group. REUTERS
