TeamPCP arrests expose a 1,000-org blast radius

Australian police charged two alleged TeamPCP members after a campaign that may have compromised more than 1,000 organizations, stolen more than 500,000 credentials, and exfiltrated at least 300GB of data. The Australian Federal Police’s release says the pair face a combined 14 offenses; the allegations remain before the courts. For builders, the lesson is governance rather than an exploit recipe: a small number of compromised dependencies can create a global blast radius, which is why the archive’s case for treating agent security as a production control belongs in every CI review.