Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others
- ID
- 18582
- Status
- summarized
- Published
- 27 Aug 2026, 10:27 PM
- Fetched
- 27 Aug 2026, 10:41 PM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/08/27/australian-police-arrest-two-over-teampcp-hacks-targeting-mercor-openai-and-others/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 7.0
- Created
- 27 Aug 2026, 10:41 PM
- Tags
- Audience
- developersai_ml_learnerssaas_founders
What happened
Australian Federal Police arrested two men in Perth accused of being members of TeamPCP, a cybercriminal group that compromised popular open-source projects to inject malicious code stealing credentials from downstream users. The group is blamed for breaching over 1,000 organizations and stealing more than 500,000 credentials, including via a compromise of the vulnerability scanner Trivy that affected companies like LiteLLM, AI recruiting startup Mercor, and others with access to GitHub and OpenAI.
Why it matters
If you run Trivy or depend on open-source tools that touch your cloud credentials, this is a concrete reminder that supply-chain attacks on developer tooling can cascade into your infrastructure. Review whether any tools in your CI/CD pipeline have access to your cloud provider or API keys, and consider pinning versions and verifying checksums rather than pulling latest. The Trivy compromise specifically means any team that ran it during the attack window should rotate exposed credentials.
Discussion angle
How many of us can actually trace which open-source tools in our build pipelines have access to our cloud credentials—and what would a practical credential-scoping policy look like for a small Malaysian startup team?