Alleged Western Sydney University hacker ‘driven by grievances’ with her institution

Police reveal the motive of the alleged 27-year-old university hacker, who police believe altered her academic marks from a fail to a pass and then threatened to sell student data on the dark web.

A former Western Sydney University student has been identified as the alleged university hacker. Picture: NSW Police

You can now listen to The Australian's articles. Give us your feedback.

You can now listen to The Australian's articles.

A former Western Sydney University student has been charged by cybercrime detectives over a series of alleged cyber hacks on the university over some four years, which police believe were “driven by (her) grievances with the university”.

Police will allege former engineering student Birdie Kingston first exploited computer systems for unauthorised discounted parking on campus but, as her technical expertise improved, altered her academic results from a Fail to a Pass mark, disrupted exams, accessed sensitive data, retrieved email communications between various people at the university, and eventually threatened to sell student data on the dark web for $40,000 in crypto.

WSU experienced a series of cyber hacks involving unauthorised access and modification of restricted information, data exfiltration, system compromise and misuse of university infrastructure – including threatening the sale of student information on the dark web - since 2021, with potentially thousands of university staff and students affected.

In April, The Australian reported that NSW Police were investigating after the personal information of about 10,000 current and former Western Sydney University students was unlawfully accessed and other sensitive data was threatened to be posted on the dark web.

WSU referred the matter to State Crime Command’s Cybercrime Squad in 2023, which investigated under Strike Force Docker - with Western Sydney University, the AFP Cyber Coordination teams, and cyber security experts all getting involved.

In September 2023, cybercrime detectives executed a search warrant at Ms Kingston’s student residence on the Kingswood campus of WSU but she was not charged.

Despite being spoken to by police and WSU, she allegedly continued to offend.

On Wednesday, strike force detectives executed another search warrant at an address in Kingswood in Western Sydney, where police located computer equipment and mobile devices. Police discovered in a cloud server in excess of 100GBs of data exfiltrated from WSU systems, which they have not yet combed through.

Ms Kingston was arrested and taken to St Marys Police Station.

She was charged with 20 offences including possess data with intent to commit computer offence, ten counts of access/modify restricted data held in computer, four counts of unauthorised modification of data with intent to cause impairment, dishonestly obtain property by deception and dishonestly obtain financial advantage etc by deception.

Detective Acting Superintendent Jason Smith said on Thursday: “We’ll allege that the offending started in 2021, with fairly simple types of intrusions. One of the initial intrusions was for the purpose of gaining discounted parking at the university.

Devices found at her address. Picture: NSW Police Force

“And the matters progressed over time, possibly as the woman gained technical capability, the incidents escalated. We also believe the incidents were driven by the person’s grievances with the university. We are aware there were a bunch of grievances over a number of years, which were not resolved to their liking. And we believe that’s a driving factor in the offending.”

“We’ll allege the particular student changed her grades from a fail to a mark that made them pass the subject,” he said.

In November 2024, Ms Kingston allegedly threatened to post data on a popular dark net forum, demanding cryptocurrency to amount of $40,000 Australian dollars. Acting Superintendent Smith said the university did not pay the ransom, and there was no evidence the data was published online.

He said the engineering student, with an electrical major, had a “high level of technical skill and capability”, working out how to reset passwords, then could move around laterally once inside the system.

“The cyber incidents I’ve referred to are part of an ongoing an sustained campaign which has caused significant disruption to Western Sydney University and a significant financial cost to investigate the matters and remediate university systems. The arrest yesterday was the culmination of a very technical and complex investigation spanning a number of years.”

She will spend her second night in custody on Thursday to appear at Parramatta Local Court on Friday.