TeamPCP Arrests: 500K Credentials Stolen From 1,000+ Orgs

For cybersecurity teams, the TeamPCP arrests are less about two hackers and more about the systemic failure of trusted developer tooling. The attackers weaponized tools your developers use daily—Trivy, KICS, and LiteLLM—to pivot from a single compromised package into half a million stolen credentials and 300GB of exfiltrated data. If your organization pulled any of these dependencies into production, the window for forensic review is now.

The coordinated arrest of two alleged TeamPCP operatives in Western Australia on August 26, 2026, marks one of the most significant law enforcement actions against software supply chain attackers. Australian Federal Police, working with the FBI and Western Australia Police, charged Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, in connection with a campaign that the AFP says compromised more than 1,000 organizations, stole half a million credentials, and exfiltrated at least 300 GB of data. The two men were taken into custody in Cottesloe and Mandurah after an investigation that began in April 2026. Thomson faces five categories of computer hacking and money laundering offenses, each carrying three to 20 years in prison, while Gaebler faces computer hacking charges with a maximum penalty of five years. These arrests are not just a criminal prosecution; they represent an attempt to disrupt a supply chain model that has quietly become one of the most effective ways to harvest enterprise secrets at scale.

“

Given that TeamPCP has been linked to breaches at the European Commission, Mistral AI, OpenAI, and GitHub, the stolen data could include sensitive government and frontier AI source code, not just routine enterprise credentials.

TeamPCP's tradecraft has been unusually effective. The group compromised trusted developer tooling and package registries—including Aqua Security's Trivy vulnerability scanner, Checkmarx's KICS, PyPI's LiteLLM, Telnyx, SAP, and TanStack packages—injecting malicious code into builds that developers then pulled into their own applications. Because these components live inside automated CI/CD pipelines, the attackers gained access to cloud access keys, authentication secrets, and source code without ever targeting an end organization directly. That indirect approach allowed TeamPCP to turn thousands of otherwise well-defended organizations into victims, while the original compromise point was a single trusted package. BleepingComputer notes that the group is not a single cohesive unit but a loose-knit collective of threat actors who frequent shared hacking forums, Discord servers, and Telegram channels. This distinguishes TeamPCP from traditional hierarchical ransomware gangs and makes attribution and disruption more difficult.

The operational details are sobering. The group deployed the Mini Shai-Hulud worm—and likely the original Shai-Hulud—to automate credential theft and self-propagation across package registries, according to SecurityWeek. The worm's ability to spread autonomously meant each compromised package could seed further infections, dramatically expanding reach. The AFP's announcement states that the financial impact includes global remediation costs estimated in the hundreds of millions of dollars. That number is likely understated, as it captures remediation rather than the downstream consequences of extortion and ransomware enabled by stolen infrastructure secrets. TeamPCP's stolen cloud access keys were funneled to extortion and ransomware groups, creating a multiplier effect where a single supply chain compromise could cascade into multiple extortion incidents across different victim organizations.

The law enforcement response, while notable, leaves significant questions unanswered. The AFP has seized devices belonging to the two men and is conducting forensic analysis, and further arrests and charges have not been ruled out. But the decentralized, forum-based nature of the collective means that removing two alleged members may not degrade TeamPCP's overall capability. The malicious infrastructure, package tampering, and credential exfiltration may continue through other affiliates or mirrored accounts. Investigators still need to determine how much money the two men earned from their activities, and whether the data they exfiltrated has already been transferred to third parties. Given that TeamPCP has been linked to breaches at the European Commission, Mistral AI, OpenAI, and GitHub, the stolen data could include sensitive government and frontier AI source code, not just routine enterprise credentials.