A former student of Western Sydney University has been arrested and charged with multiple cybercrime offences following an alleged four-year hacking campaign that began with attempts to obtain discounted campus parking and escalated to threats of selling confidential student data on the dark web. As reported by The Guardian, the 27-year-old woman was taken into custody on Wednesday and faces 20 charges, including “unauthorised access or modification of restricted computer data, dishonestly obtaining financial advantage by deception,” and “modification of data with intent to cause impairment.”

A former student of Western Sydney University has been arrested and charged with multiple cybercrime offences following an alleged four-year hacking campaign that began with attempts to obtain discounted campus parking and escalated to threats of selling confidential student data on the dark web. As reported by The Guardian, the 27-year-old woman was taken into custody on Wednesday and faces 20 charges, including “unauthorised access or modification of restricted computer data, dishonestly obtaining financial advantage by deception,” and “modification of data with intent to cause impairment.” According to NSW Police, the woman initially exploited university systems to secure reduced-rate parking. However, her activity allegedly intensified over time to include altering her academic records and ultimately attempting to ransom the university by threatening to leak sensitive student information. On Thursday, Detective Acting Superintendent Jason Smith  said, “we’re aware there were a number of grievances that she believed were unresolved, which we believe to be the driving factor behind the offending.” A police raid of her Kingswood apartment in Sydney’s west uncovered more than 100 gigabytes of data along with multiple digital devices, including computers, servers, and mobile phones. Police allege the cyberattacks date back to 2021 and included unauthorised system access, data theft, infrastructure misuse, and an incident involving threats to sell student information via the dark web. ‘Hundreds of university staff and students are believed to have been impacted.’ From November 2024, the former electrical engineering student allegedly began issuing ransom threats, demanding “$40,000 in cryptocurrency” in exchange for halting the release of sensitive university data. Authorities had previously searched the suspect’s home in September 2023, but the subsequent raid this week led to her arrest and the filing of 21 cybercrime and fraud-related charges. She remains in custody ahead of her scheduled appearance at Parramatta Local Court on Friday. Western Sydney University confirmed the incidents had a significant impact on its community and said it had taken steps to enhance its cybersecurity infrastructure in response. “In light of these events, we have employed specialist staff and adopted advanced technologies to better detect, respond to, and defend against cyber threats,” the university said in a statement. Professor Ryan Ko, a cybersecurity expert from the University of Queensland, said universities often face unique challenges in protecting data due to their complex operational environments. “Institutions like universities are often more porous in terms of data protection,” Prof Ko explained. “Many individuals hold multiple roles [such as postgraduate students who may also be staff] making access controls more complicated.” He added that it's not uncommon for cybercriminals to begin with minor breaches before escalating their actions. “These offenders tend to be opportunistic, often targeting low-hanging fruit. In this case, that appears to have been campus parking,” Prof Ko said.

A little more informed. A little more connected.