19-Year-Old Student Pleads Guilty to Massive PowerSchool Hack and Million-Dollar Extortion

Matthew D. Lane, a 19-year-old Massachusetts college student, pleaded guilty to federal charges that he led a massive cyberattack against PowerSchool, an educational platform widely used in the U.S. and Canada. Between April and May 2024, Lane used stolen credentials to illegally access a cloud storage provider that services school systems in the U.S. and Canada. In doing so, he managed to transfer confidential data of more than 60 million students and 10 million teachers to a server in Ukraine.

The actor demanded a ransom of $2.85 million in Bitcoin not to disclose the stolen information, which included personal data, social security numbers and medical details. In addition to the PowerSchool leak, Lane also faces charges for the attempted extortion of U.S. telecommunications company AT&T, in which he demanded a $200,000 ransom and threatened company executives if the ransom was not paid.

The charges filed against Lane include conspiracy to commit cyber racketeering, extortion, unauthorized access to protected systems and identity theft. Each charge related to computer fraud could result in up to five years in prison, supervised release and substantial financial penalties, while the identity theft charge carries a two-year consecutive prison term.

The case has generated great concern in the education and technology sector, and authorities are tightening cybersecurity on educational platforms. Lane will be sentenced shortly and remains under a presumption of innocence until the official acceptance of his guilty plea.