Former Western Sydney University student charged after allegedly hacking system for personal gain over years

A former university student is facing 20 cybercrime charges after allegedly hacking into school systems to score discounted parking, alter her marks, and steal confidential data.

Birdie Kingston, 27, was arrested on Wednesday after police alleged she had been exploiting Western Sydney University’s systems since 2021, when she was studying engineering with an electrical major.

Her offending allegedly began with attempts to get discounted parking on campus, before escalating to changing her marks from a fail to a pass.

Police allege the cyber attacks continued over several years, with the university only discovering the breaches in 2023 and referring the matter to authorities.

In September 2023, police searched Kingston’s on-campus accommodation in Kingswood, but no arrest was made at the time.

Despite the police search and the university keeping a close watch on her, the hacking allegedly continued even after she left the university.

Police allege Kingston went on to access sensitive systems, download more than 100GB of data, and threaten to sell confidential student information on the dark web.

In November last year, she allegedly demanded cryptocurrency worth around $40,000 from the university, warning the stolen data would be sold on a popular darknet forum if the ransom wasn’t paid.

Detective Acting Superintendent Jason Smith said on Thursday that the university did not pay the ransom, and there is no evidence the data was ever sold or published.

Hundreds of university staff and students are believed to have been affected.

After years of investigation, police eventually turned their attention back to Kingston after identifying similar methods used across the series of cyber incidents.

A number of her computer equipment and mobile devices were seized and will now be examined to determine exactly what data was accessed or taken.

Smith alleged Kingston’s long-standing grievances with the university may have been a key motivator behind the alleged offences.

“When you look at all of these (alleged) offences it’s very apparent that the person behind them has a very high level of technical skill and capability,” he said.

Kingston has been charged with 20 offences, including multiple counts of accessing or modifying restricted data, unauthorised modification of data with intent to cause impairment, and carrying out unauthorised functions with intent to commit a serious offence.

She also faces charges relating to possession of data for criminal purposes, dishonest financial gain, and making threats with the intent to obtain a benefit or cause loss.

Smith said some of the charges carry significant penalties.

“The demand money offence is in itself quite a serious charge and there are other offences relating to the unauthorised modification of data which carry a penalty of up to 10 years,” he said.

Kingston was refused bail to appear in Parramatta Local Court on Thursday.