New South Wales (NSW) Police in Australia have announced the arrest of a 27-year-old former Western Sydney University (WSU) student, on charges of breaching university systems and stealing data dating back to 2021. The woman, allegedly identified as Birdie Kingston, faces 20 charges of unauthorized access, breach of information systems and leaking sensitive data.
What began as an effort to secure cheaper parking evolved—according to authorities—into a widespread digital infiltration campaign that allegedly compromised the personal information of thousands of students and university staff members
“ Since 2021, WSU has been the target of successive cyberattacks, with data breaches, unauthorized access to critical systems, and abuse of university infrastructure – including the threat to sell student information on the dark web ,” a police spokesperson said
See also: Iranian hackers leaked data of Saudi Games athletes
Target 47,000 students and 4,500 employees
WSU is one of Australia's largest universities, with over 47,000 registered students and 4,500 staff, and an annual budget of over $600 million. Its infrastructure has apparently been the target of repeated attacks, which the institution has gradually revealed over the past year.
- May 2024: The university confirmed a breach in its Microsoft Office 365, which had begun a year earlier, affecting 7,500 people.
- April 2025: Two new incidents. The first involved a breach of the University's single sign-on (SSO) between January and February 2025, affecting approximately 10,000 students. The second incident involved a data leak on the dark web, which began on November 1, 2024.
Authorities believe that former student Birdie Kingston may be behind all of these major security incidents (and others) that have been recorded over the past four years.
Australia: Former student in court for cyberattacks at WSU
During the arrest operation carried out in Kingswood, New South Wales police seized computers and mobile phones, which may contain crucial digital evidence of the actions of 27-year-old Birdie Kingston.
See also: Hackers target developers with 35 malicious npm packages
Investigators believe that the defendant's activity escalated from simple violations – such as altering access to student parking and modifying academic records – to serious extortion attempts, culminating in the threat of posting personal data on the dark web.
According to local media reports, Kingston was officially warned by police as early as September 2023, when she was still living in the student dormitories. However, she allegedly ignored the authorities and continued her cyberattacks against the institution.
The same reports mention the theft of over 100GB of sensitive data, falsification of grades, illegal access to parking privileges, as well as threats to sell student information on dark web forums. In one of the cases, Kingston allegedly demanded a ransom of $40,000 in cryptocurrency in order to keep the data from being made public.
WSU declares cooperation with authorities
In a statement to BleepingComputer, Western Sydney University confirmed its cooperation with authorities and thanked the police for their input:
"Western Sydney University is working with the NSW Police to support the investigations. These incidents have had a serious impact on the university community and we deeply appreciate the assistance of the authorities. As the matter is now before the courts, we will not be making any further comment," a spokesperson for the institution said.
The Birdie Kingston case is indicative of a disturbing, but no longer rare, reality in the field of cybersecurity: access to and familiarity with technology gives individuals enormous power, capable of threatening even high-profile organizations with infrastructure worth millions.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: APT28 hackers use Signal to distribute malware
What began—if the allegations are true—as an attempt to scam people into cheaper parkinghas evolved into a multi-year digital campaign, with data theft, system tampering, and blackmail attempts. If anything, it shows:
- How fragile are digital defenses even in large educational institutions.
- How a person with sufficient skills can exploit insider knowledge, avoid detection for years, and gain access to a huge amount of sensitive data.
- That cybercrime does not need organized networks – it can come from one individual with the right motivation and technical ability.
The case also highlights a gap in the handling of “known perpetrators”: the police had already warned her in 2023, but she reportedly continued unmolested. This raises questions about the adequacy of monitoring and response to incidents that go beyond the purely technical level and touch upon criminal liability.
Finally, for the university itself, the situation highlights the need to strengthen security policies: not only technologically, but also at the level of internal access management, controls and training of staff and students. Organizations can no longer consider security a luxury or the responsibility of the IT department alone.
Source: www.bleepingcomputer.com
