Perth arrests reveal the supply chain blind spot in Australian cyber cover

Arrests in Perth are drawing attention to a “supply chain blind spot” in Australian cyber insurance, after an alleged software supply-chain attack compromised at least 1,000 organisations worldwide. Police say Ruben Ian Thomson, 21, of Cottesloe, and Louis Michael Gaebler, 23, of Mandurah were charged on August 26, 2026, following an investigation that began in April 2026 involving the Australian Federal Police, Western Australia Police Force and the FBI. Authorities allege malicious code was inserted into software on an open-source repository and then used unknowingly by other developers. The compromised software is said to have stolen more than 500,000 credentials, exfiltrated at least 300 gigabytes of data, and created remediation costs estimated in the hundreds of millions of dollars. Thomson faces eight charges, including offences linked to intent, modification of data, a breach of a 3LA order and dealing with proceeds.