A 27-year-old former Western Sydney University student has been charged with 20 offences following an extensive cyber attack campaign against the institution that began in 2021. Strike force detectives, working closely with Western Sydney University, the AFP Joint Policing Cyber Coordination Centre, JCP3 and cyber security experts, identified the alleged hacker was a former student of the university. The woman, identified by local media as Birdie Kingston, was arrested at her Kingswood home during a police raid where officers seized computer equipment and mobile devices. She was refused bail and appeared in Parramatta Local Court on Thursday.
Police allege she was behind a series of cyber attacks on Western Sydney University, beginning in 2021. They say it began with system exploits in an attempt to secure unauthorised discounts for parking on campus. But it allegedly escalated into alterations to her academic results and threats to sell other students’ confidential data on the dark web. The attacks involved multiple security breaches including the compromise of one of the University’s single sign-on (SSO) systems between January and February 2025, exposing approximately 10,000 students. Investigators allege the suspect exfiltrated over 100GB of confidential student data and threatened to sell the stolen information on dark web marketplaces.
The case highlights the evolving nature of insider threats in educational institutions, where what began as a relatively minor attempt to obtain discounted parking evolved into sophisticated attacks compromising thousands of students’ personal information. By exploiting vulnerabilities in the university’s single sign-on (SSO) systems between January and February 2025, the attacker gained unauthorized access to sensitive data repositories. This allowed her to alter academic records, exfiltrate over 100GB of confidential student data, and later threaten to distribute it through criminal networks.