Australian police arrested two men in Perth over TeamPCP-related hacks.
Why it matters: The arrests mark a concrete enforcement step in a cross-border cyber probe tied to major AI and tech firms. The case underscores how software supply-chain attacks can spread far beyond the initial target.
- Police arrested Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, in Perth on Aug. 26, 2026.
- The arrests followed a joint investigation by the Australian Federal Police, Western Australia Police and the FBI.
- U.S. prosecutors said Thomson was indicted on Aug. 25 and the indictment was unsealed on Aug. 27.
- TechCrunch reported TeamPCP was linked to compromises involving OpenAI, Mercor, GitHub, the European Commission and others.
Australian police arrested two men in Perth, Western Australia, on Aug. 26 in connection with the TeamPCP hacking probe, according to ABC. The men were identified as Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23.
The arrests came from a joint investigation involving the Australian Federal Police, Western Australia Police and the FBI. AFP Commander Graham Marshall called the men “internationally significant cybercrime threat actors.”
In a separate statement, the U.S. Justice Department said Thomson was indicted on Aug. 25 and that the indictment was unsealed on Aug. 27. The department said the alleged TeamPCP campaign targeted trusted software supply-chain tools, then spread to downstream customers, stealing sensitive data and extorting ransom payments. Read the DOJ filing here.
TechCrunch reported TeamPCP had been linked to compromises involving OpenAI, Mercor, GitHub, the European Commission and other organizations. ABC said police believe more than 1,000 organizations worldwide may have been affected, with more than 500,000 credentials and authentication materials allegedly harvested.
Police said the investigation began in April 2026 after tips from cybersecurity companies and later led to the seizure of devices and large volumes of data. ABC reported authorities collected 100 terabytes of data, and TechCrunch said victims were expected to be notified.
By the numbers
- 2 - Suspects arrested in Perth.
- 1,000+ - Organizations worldwide police believe may have been affected.
- 500,000+ - Credentials and authentication materials allegedly harvested.
Yes, but: The precise victim list and the role of the second arrested person were not fully detailed in the available sources.
What's next: Authorities are expected to notify victims. Court proceedings and any additional charge details may follow.