Massachusetts Student Pleads Guilty to PowerSchool Data Breach
BOSTON – A college student from Massachusetts has agreed to plead guilty to hacking into the cloud-based education software company PowerSchool, leading to the theft of sensitive information belonging to millions of students and teachers. This data was later used by criminals to extort both the company and various school districts for ransom payments.
Matthew Lane, 19, finalized a plea deal on Tuesday during proceedings in federal court in Worcester. This deal addresses charges connected to the hacking incidents involving two companies, which were also victims of extortion attempts.
Though the court documents do not specifically name the companies affected, a source familiar with the situation confirmed that PowerSchool was indeed one of them. This case marks a significant development as it officially identifies the perpetrator of the data breach that compromised information for tens of millions of children. PowerSchool’s services cater to more than 18,000 schools and support around 60 million students.
Lane, a student at Assumption University, was described by U.S. Attorney Leah Foley as having caused fear among parents over the potential exposure of their children’s data, allegedly for the sake of enhancing his hacking reputation.
No comments were received from Lane’s attorney regarding the plea.
In January, PowerSchool made the breach public, reporting that the incident came to their attention on December 28, 2024. They opted to pay a ransom to prevent the sensitive information from being publicly released.
Additionally, PowerSchool noted earlier this month that several school districts also faced extortion demands concerning the same compromised data.
According to prosecutors, Lane exploited the credentials of a PowerSchool contractor in September to infiltrate the company’s network and extract student and teacher information. By December, Lane had transferred this data to a server he rented from a cloud service in Ukraine.
Shortly afterward, PowerSchool received a ransom demand threatening to release personal details—including names, addresses, and Social Security numbers—of over 60 million students and 10 million teachers unless a payment of $2.85 million in bitcoin was made.
Prior to targeting PowerSchool, Lane, along with others, had reportedly plotted to extort an unnamed telecommunications firm for a $200,000 ransom to keep stolen data from being revealed.
Lane agreed to plead guilty to charges of cyber extortion, aggravated identity theft, and unauthorized access to protected computers. He may face a minimum of two years in prison.
