Former student charged over alleged cyber attacks at Western Sydney University

A former student allegedly demanded about $40,000 worth of cryptocurrency during a series of cyber attacks on a university.

A former student who allegedly demanded about $40,000 worth of cryptocurrency during a series of cyber attacks on Western Sydney University was driven by a grievance against the institution, police have said.

Kingswood woman and former engineering student Birdie Kingston, 27, is due to face a Sydney court on Friday after she was arrested over a series of alleged brazen hacks spanning four years.

It’s alleged that her cyber attacks escalated dramatically from securing discounted parking and changing her grades from a pass to a fail before she in November last year threatened to release data onto the internet and demanded payment.

Detective Acting Superintendent Jason Smith from the NSW Police Cybercrime Squad on Thursday said a demand was posted on a dark net forum threatening to release the data unless about $40,000 worth of cryptocurrency was handed over.

Police allege Ms Kingston’s first cyber attack was in 2021 when she was still a student and the matter was first referred to police in 2023 when officers searched her home and spoke to her; however, she was not charged at that point.

“It is quite astounding that someone that was being spoken to by the university and by police would continue to offend, but that’s what we’re alleging,” Superintendent Smith said.

The former student was taken to St Marys Police Station. Picture: NSW Police Force

It’s alleged that she continued her cyber attacks and after a two-year investigation she was arrested at a Kingswood home on Wednesday.

She is facing more than 20 charges, including 10 counts of accessing/modifying restricted data held in a computer, four counts of unauthorised modification of data with intent to cause impairment and dishonestly obtaining financial advantage by deception.

The most serious charges carry a maximum of 10 years in jail if she is convicted.

Police seized mobile phones and computers and are combing through more than 100GB worth of data that was retrieved from a cloud server.

“It is a large quantity, so we’re not able to say what that data actually contains,” Superintendent Smith said.

It’s not alleged that the data was ever posted to the internet and the university did not pay the ransom.

Ms Kingston was refused bail and is due to appear before Parramatta Local Court on Friday.

Computer equipment was seized in the search. Picture: NSW Police Force

“As the woman gained technical capability the incidents escalated,” Superintendent Smith alleged.

“We also believe that the incidents were driven by the person’s grievances with the university.

“We’re aware there were a number of grievances over a period of years which were not resolved to their liking and we believe that’s a driving factor behind their (alleged) offending.”

Investigations are ongoing through Strike Force Docker.