Australian police arrested two individuals in Perth on Thursday and charged them with more than a dozen cybercrime offenses related to the hacking group TeamPCP. The suspects face allegations of compromising open source software projects, stealing credentials and data, and attempting to extort victims for ransom. Federal Police said the pair are accused of breaching more than a thousand organizations as part of a supply chain attack that involved modifying popular open source tools. The attacks, which the FBI cyber division chief Brett Leatherman said targeted over a thousand entities, resulted in the theft of more than half a million credentials, according to police. The group was linked to intrusions of the vulnerability scanner Trivy, affecting companies such as LiteLLM and AI recruiting startup Mercor, as well as alleged breaches of the European Commission’s cloud infrastructure and projects associated with GitHub and OpenAI. Investigators began in April 2026 after receiving reports from multiple cybersecurity firms. Police seized a large quantity of allegedly stolen data, devices and other electronics during the operation and said they intended to notify affected parties. One of the arrested individuals has been identified by journalist Brian Krebs as Ruben Thomson, who used the handle Ellis and was described as the leader of TeamPCP until March 2026. Authorities have not disclosed whether they will seek extradition, and the FBI declined to comment when contacted. The case remains under investigation.