A young man from Massachusetts has been sentenced to four years in prison for infiltrating the network of education software provider PowerSchool and stealing data from millions of students and teachers to extort the company. Matthew Lane, 20, was sentenced by U.S. District Judge Margaret Guzman in Worcester, Massachusetts, after admitting guilt in June to charges related to hacking two companies, including PowerSchool based in California.
The breach at PowerSchool in December 2024 exposed sensitive information of over 2.7 million current and former Canadian students, as well as numerous individuals in the U.S. Depending on the data stored by school boards, compromised information included names, birth dates, addresses, emergency contact details, and even social insurance numbers.
Various school systems across Canada, such as those in Alberta, Ontario, Manitoba, Newfoundland and Labrador, Nova Scotia, Northwest Territories, Prince Edward Island, and Saskatchewan, primarily utilize the web-based platform for managing students’ personal, medical information, grades, and other particulars. Some also utilize it to communicate with families.
In addition to the prison sentence, Lane was ordered by Guzman to pay over $14 million US in restitution and a $25,000 fine, according to U.S. Attorney Leah Foley’s office. A representative from PowerSchool expressed gratitude towards the prosecutors and law enforcement for bringing Lane to justice. Lane’s lawyer did not respond to requests for comments.
Lane, who was a student at Assumption University in Worcester at the time of his initial charges, pleaded guilty in June to cyber extortion, aggravated identity theft, and unauthorized access to protected computers. Prosecutors revealed that Lane exploited a previous data breach at a telecommunications company in mid-2024, posing as a member of a notorious hacking group and demanding a $200,000 ransom to prevent the leakage of company data. Utilizing stolen login credentials, Lane accessed PowerSchool’s network, enabling him to pilfer personal data of students and teachers.
Following the breach, PowerSchool received a ransom demand threatening to expose sensitive data of millions of individuals unless a $2.85 million bitcoin ransom was paid. This demand was linked to the same hacking group Lane claimed affiliation with during the telecommunications extortion. PowerSchool chose to pay the ransom to prevent data exposure. Subsequently, several school boards in Canada received ransom demands based on data obtained in the PowerSchool breach.
