Australian authorities have arrested and charged two men, aged 21 and 23, accused of being part of TeamPCP, a hacking group linked to widespread supply-chain attacks targeting open-source software and developer platforms, the Australian Federal Police said on Tuesday. The group is alleged to have compromised over a thousand organizations worldwide, stealing half a million credentials and exfiltrating at least 300GB of data, with global remediation costs estimated at hundreds of millions of dollars.

The two men were arrested in the western Australian cities of Cottesloe and Mandurah on August 26 following an investigation that began in April. Police allege they received cryptocurrency payments for their involvement. High-profile attacks attributed to TeamPCP have impacted packages from Trivy, LiteLLM, Telnyx, SAP and TanStack, as well as breaches of the European Commission, Mistral AI, OpenAI and GitHub. The suspects face a combined 14 charges carrying maximum penalties of 3 to 20 years' imprisonment per charge, Bill Toulas reports for BleepingComputer.