Story perspectives

Australian police arrest TeamPCP in software supply-chain attack

8/27/2026

Summary

Story summary

Australia’s Federal Police arrested two Western Australian men for alleged involvement in a software supply-chain attack.
The 21-year-old and 23-year-old face 14 offences, including proceeds-of-crime charges.
Police allege the group inserted malicious code into open-source software, compromising over 1,000 organisations.
The breach stole more than 500,000 credentials and exfiltrated at least 300 GB of data.
FBI Cyber Division Assistant Director Brett E. Leatherman identified the syndicate as TeamPCP and highlighted international cooperation.

History

Historical Context

On 27 June 2017 the NotPetya wiper spread through a compromised update of Ukraine’s M.E.Doc tax software, a supply-chain breach attributed to the Russian GRU-linked Sandworm group and later assessed to have caused roughly $10 billion in global damage. Recently the Australian Federal Police moved against TeamPCP for inserting malicious code into open-source libraries that affected over 1,000 organizations worldwide.

1 of 2

Story summary

Australia’s Federal Police arrested two Western Australian men for alleged involvement in a software supply-chain attack.
The 21-year-old and 23-year-old face 14 offences, including proceeds-of-crime charges.
Police allege the group inserted malicious code into open-source software, compromising over 1,000 organisations.
The breach stole more than 500,000 credentials and exfiltrated at least 300 GB of data.
FBI Cyber Division Assistant Director Brett E. Leatherman identified the syndicate as TeamPCP and highlighted international cooperation.

1 / 2