U.S. college student pleads guilty in data breach that affected North American schools

Thomson Reuters

· Posted: May 20, 2025 9:49 PM EDT | Last Updated: 6 hours ago

A Massachusetts assemblage pupil has agreed to plead blameworthy to hacking cloud-based acquisition bundle supplier PowerSchool and stealing information pertaining to millions of North American students and teachers that hackers utilized to extort the institution and schoolhouse districts into paying ransoms.

Matthew Lane, 19, entered into a plea woody connected Tuesday to resoluteness charges filed successful national tribunal successful Worcester, Mass., related to the hacking of 2 companies, which were past extorted for ransoms.

Court papers did not place the affected companies by name, but a idiosyncratic acquainted with the substance confirmed PowerSchool was 1 of the victims.

The charges marked the archetypal clip authorities had identified who was liable for a information breach astatine PowerSchool that appeared to exposure the information of tens of millions of children. PowerSchool's bundle is utilized by much than 18,000 schools to enactment implicit 60 cardinal students.

In Canada, schoolhouse boards in Ontario, Saskatchewan, Alberta, Newfoundland and Labrador, Nova Scotia, Prince Edward Island, Manitoba and the Northwest Territories were among those affected by the monolithic breach.

'A notch successful his hacking belt'

Lane is simply a pupil astatine Assumption University successful Worcester. U.S. Attorney Leah Foley successful a connection said his actions "instilled fearfulness successful parents that their kids' accusation had been leaked into the hands of criminals — all to enactment a notch successful his hacking belt."

Lane's lawyer did not respond to requests for comment.

Folsom, Calif.-based PowerSchool disclosed the breach successful January. It has said it learned of it connected Dec. 28, 2024 and decided to wage a ransom to forestall information from being made public.

PowerSchool said earlier this period that aggregate schoolhouse districts person besides received extortion demands related to the aforesaid data.

According to prosecutors, Lane utilized the credentials of a PowerSchool contractor successful September to summation entree to its web and get pupil and teacher data.

In December, helium transferred information connected students and module to a machine server helium leased from a unreality retention supplier successful Ukraine, according to prosecutors.

Days later, PowerSchool received a ransom request threatening to leak the names, addresses, Social Security numbers and different delicate information belonging to much than 60 cardinal students and 10 cardinal teachers unless it paid $2.85 cardinal US worthy of bitcoin, according to prosecutors.

They said that earlier hacking PowerSchool, Lane and others conspired to extort an unnamed telecommunications institution into paying a $200,000 US ransom to debar the disclosure of information stolen from its network.

He agreed to plead blameworthy to engaging successful cyber extortion and aggravated individuality theft and accessing protected computers without authorization. He faces astatine slightest 2 years successful prison.