More than 40 staff at northern beaches school targeted with malware by colleague

More than 40 staff members at a school on Sydney’s northern beaches have allegedly had their personal data stolen by one of their own colleagues via malware that police say was deployed on school computers.

Aaron Pennesi, 28, was arrested by specialist officers from the Cybercrime Squad in March after the Department of Education asked detectives to investigate malware at The Forest High.

Malware is software designed to provide unauthorised access to a computer.

Pennesi, who is on bail, has been charged with the unauthorised modification of data with intent to cause impairment, possessing identity information to commit an indictable offence, two counts of unauthorised function with intent to cause a serious offence and possessing child abuse material.

Court documents obtained by the Herald show Pennesi is alleged to have deployed malware to capture computer passwords without detection between February 29 and March 4 this year.

He is also accused of deploying malware on other occasions in November last year and on another date in February this year.

Police further say he was in possession of photographs of a colleague’s driver’s licence, Medicare card and multiple debit and savings cards.

When investigators went to Pennesi’s Matraville home in March, they also seized a computer and a phone, on which they found child abuse material.

Court documents allege Pennesi was in possession of 69 videos and 21 photographs depicting the sexual abuse of children. None was linked to the school or students.

Police will allege in court the malware on the school computers were in various stages of development and deployment, with at least 41 members of staff having had information including their credit card details captured.