Joint AFP, Western Australia Police Force and FBI release: two West Australian men were charged on 26 August 2026 with a combined 14 offences after Perth search warrants. Police allege a syndicate inserted malicious code into software on an open-source repository that other developers then pulled in. The AFP estimates more than 1,000 organisations globally, more than 500,000 credentials, and at least 300 GB of data, with remediation costs in the hundreds of millions of dollars.

The FBI statement in that release names the group TeamPCP. The men are not named in the AFP release. The investigation continues; further arrests have not been ruled out. (source: AFP)

Correction (28 Oct 2026): removed an internal label and a statement that TeamPCP used an autonomous multi-agent framework to harvest credentials in under six hours. (source: AFP)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: AFP)