Two Australians Charged for TeamPCP Supply Chain Attacks

Key Takeaways

• Two Australian men have been charged in connection with alleged TeamPCP supply chain attacks.
• The attacks involved injecting malicious code into open-source software, affecting over 1,000 organizations globally.
• The syndicate is accused of stealing over 500,000 user credentials and more than 300 GB of data.
• Remediation costs are estimated to be in the hundreds of millions of dollars.
• The investigation is ongoing, with potential for further arrests.

Australian Authorities Charge Two Men in Global Supply Chain Attack

Australian law enforcement has brought charges against two men from Western Australia, alleging their involvement in sophisticated TeamPCP supply chain attacks. These operations reportedly embedded malicious open-source code into widely used software components, subsequently compromising over 1,000 organizations across the globe.

The Australian Federal Police (AFP), in collaboration with the Western Australia Police Force (WAPF) and the U.S. Federal Bureau of Investigation (FBI), executed search warrants in Perth, leading to the charges on August 26, 2026. The two individuals face a combined 14 offenses and are scheduled to appear in Perth Magistrates Court on August 27, 2026.

Investigators contend that the accused were key figures in a highly organized criminal syndicate engaged in data breaches, identity theft, and cryptocurrency-based money laundering. The group allegedly injected malicious code into software hosted on open-source repositories, which was then unknowingly incorporated by other developers into their own projects.

This compromised software reportedly infiltrated systems across government, academic institutions, and the private sector, facilitating the theft of user credentials and authentication data. Parallel investigations by the AFP and FBI commenced in April 2026, following alerts from multiple cyber threat assessment firms regarding the campaign.

International Cooperation Leads to Arrests

Brett E. Leatherman, Assistant Director of the FBI Cyber Division, confirmed that the suspects are believed to be members of the TeamPCP group. He emphasized that these arrests represent a significant step in imposing consequences on those responsible for software supply chain attacks.

Authorities estimate the malicious code potentially compromised over 1,000 organizations worldwide, leading to the theft of more than 500,000 credentials and the exfiltration of at least 300 gigabytes of data. The ripple effect of compromising a limited number of trusted software components resulted in substantial global impact, with remediation costs potentially reaching hundreds of millions of dollars. The inherent trust developers place in open-source packages means that a compromised component can spread extensively once integrated into production systems.

On August 26, 2026, AFP and WAPF officers executed warrants at properties in Cottesloe, Hamilton Hill, and Mandurah, seizing various devices for forensic examination. Police allege the men received cryptocurrency payments, the total value of which is still under investigation.

A 21-year-old man from Cottesloe faces eight charges, including unauthorized modification of data, possessing and supplying data with intent to commit a computer offense, failing to comply with a section 3LA order, and dealing with proceeds of crime valued at $100,000 or more, a charge that carries a maximum penalty of 20 years’ imprisonment.

A 23-year-old man from Mandurah faces six similar computer-related offenses. The investigation remains active, and authorities have not ruled out further arrests.

AFP Commander Graeme Marshall highlighted the increasing professionalism of cybercrime syndicates, underscoring the critical role of industry intelligence in this particular case. Western Australia Police Force Acting Commander Peter Foley noted that the disruption demonstrates how cybercriminals can blend into the community. He urged organizations to maintain robust security measures and to report any incidents through Report Cyber. Individuals concerned about potential identity compromise can seek assistance from IDCARE, with additional guidance available from the Australian Cyber Security Center.

What You Should Do

• Regularly audit your open-source dependencies for any signs of compromise or unexpected changes.
• Implement robust supply chain security practices, including integrity checks for all third-party components.
• Ensure all systems and software are kept up-to-date with the latest security patches.
• Utilize strong, unique passwords and multi-factor authentication (MFA) for all accounts, especially those with access to sensitive data or development environments.
• Monitor network traffic for unusual activity that could indicate data exfiltration or unauthorized access.
• Report any suspected cyber incidents to relevant authorities, such as Report Cyber in Australia.
• If you suspect your identity has been compromised, contact organizations like IDCARE for support.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.