A Massachusetts college student has agreed to plead guilty to federal charges stemming from a cyberattack and subsequent extortion scheme that targeted one of North America’s largest education technology companies, authorities confirmed.
Matthew D. Lane, 19, faces accusations of using stolen login credentials to infiltrate and compromise the systems of a major software provider, widely believed to be PowerSchool, a company serving school districts throughout the United States and Canada. According to prosecutors, Lane’s intrusion compromised sensitive personal data from more than 60 million students and around 10 million teachers and staff.
The stolen data included highly sensitive information such as names, addresses, phone numbers, Social Security numbers, medical records, and school grades. Prosecutors noted the breach not only captured current records, but in some cases included decades of historical student data. Although the indictment did not explicitly name PowerSchool, the details provided clearly align with a previously acknowledged breach of the company’s systems reported earlier this year. PowerSchool disclosed in January that an unauthorized access event affecting its servers had occurred as early as September 2024, impacting a vast number of students and educators across the continent.
Prosecutors allege that Lane conspired with another unidentified individual, located in Illinois, to extort roughly $2.85 million worth of cryptocurrency from the company. Earlier this year, PowerSchool confirmed it had, indeed, paid cybercriminals to ensure the deletion of the stolen data, but declined to publicly confirm the ransom amount. Multiple school districts subsequently reported receiving further extortion threats, suggesting the stolen data had perhaps not been destroyed as claimed.
Federal investigators substantiated these ongoing threats, confirming that ransom demands were linked to the original breach and matched previously stolen samples of student data. A spokesperson from PowerSchool declined to comment specifically on Lane’s case or to confirm the exact amount of the payout, deferring all queries instead to the U.S. Attorney’s Office for Massachusetts, which did not immediately provide a statement.
Separately, authorities noted Lane was also implicated in hacking and extortion involving a U.S.-based telecommunications provider, though details about that second targeted entity have not been publicly disclosed in court filings.
Lane’s attorney did not respond to requests for comment regarding his client’s plea agreement.
