Student Admits Guilt in Massive PowerSchool Data Breach
A 19-year-old Massachusetts student, Matthew D. Lane, has agreed to plead guilty to federal charges related to the hacking and extortion of PowerSchool, a leading education technology company.
The breach, which occurred between August and September 2024, compromised the personal data of over 60 million students and 10 million teachers across North America. Stolen information included names, addresses, phone numbers, Social Security numbers, medical information, and school grades. In some cases, decades of historical student data were compromised.
Extortion and Ransom
Lane and an unnamed co-conspirator from Illinois allegedly demanded $2.85 million in cryptocurrency from PowerSchool. While PowerSchool confirmed paying a ransom to delete the stolen data in January 2025, the company declined to disclose the amount. Following the initial breach, several school districts reported extortion attempts, though PowerSchool stated these were related to the original incident.
Impact and Investigation
The data breach impacted schools primarily in the United States and Canada that utilize PowerSchool's software for managing student information. The U.S. Attorney’s Office for Massachusetts is leading the investigation. Lane is also accused of hacking and extorting a U.S. telecoms provider.
PowerSchool acknowledged the plea agreement and deferred comment to the U.S. Attorney’s Office, which has not yet responded to requests for comment. Lane's attorney also declined to comment.
