A Massachusetts college student has agreed to plead guilty to hacking cloud-based education software provider PowerSchool and stealing data pertaining to millions of North American students and teachers that hackers used to extort the company and school districts into paying ransoms.
Matthew Lane, 19, entered into a plea deal on Tuesday to resolve charges filed in federal court in Worcester, Mass., related to the hacking of two companies, which were then extorted for ransoms.
Court papers did not identify the affected companies by name, but a person familiar with the matter confirmed PowerSchool was one of the victims.
The charges marked the first time authorities had identified who was responsible for a data breach at PowerSchool that appeared to expose the data of tens of millions of children. PowerSchool’s software is used by more than 18,000 schools to support over 60 million students.
In Canada, school boards in Ontario, Saskatchewan, Alberta, Newfoundland and Labrador, Nova Scotia, Prince Edward Island, Manitoba and the Northwest Territories were among those affected by the massive breach.
‘A notch in his hacking belt’
Lane is a student at Assumption University in Worcester. U.S. Attorney Leah Foley in a statement said his actions “instilled fear in parents that their kids’ information had been leaked into the hands of criminals — all to put a notch in his hacking belt.”
Lane’s attorney did not respond to requests for comment.
Folsom, Calif.-based PowerSchool disclosed the breach in January. It has said it learned of it on Dec. 28, 2024 and decided to pay a ransom to prevent data from being made public.
PowerSchool said earlier this month that multiple school districts have also received extortion demands related to the same data.
According to prosecutors, Lane used the credentials of a PowerSchool contractor in September to gain access to its network and obtain student and teacher data.
In December, he transferred data on students and faculty to a computer server he leased from a cloud storage provider in Ukraine, according to prosecutors.
Days later, PowerSchool received a ransom demand threatening to leak the names, addresses, Social Security numbers and other sensitive data belonging to more than 60 million students and 10 million teachers unless it paid $2.85 million US worth of bitcoin, according to prosecutors.
They said that before hacking PowerSchool, Lane and others conspired to extort an unnamed telecommunications company into paying a $200,000 US ransom to avoid the disclosure of data stolen from its network.
He agreed to plead guilty to engaging in cyber extortion and aggravated identity theft and accessing protected computers without authorization. He faces at least two years in prison.
