A man from Massachusetts has been sentenced to four years in prison for infiltrating the network of education software provider PowerSchool and stealing data belonging to millions of students and teachers. Matthew Lane, aged 20, received his sentence from U.S. District Judge Margaret Guzman in Worcester, Massachusetts, after pleading guilty in June to charges related to hacking two companies, including PowerSchool based in California.
The breach at PowerSchool in December 2024 exposed sensitive information of over 2.7 million current and former Canadian students, along with additional data from the United States. The compromised data included names, birth dates, addresses, emergency contact details, and even social insurance numbers, depending on the information retained by the school boards.
School systems in various Canadian provinces primarily utilize the web-based PowerSchool system to manage students’ personal information, grades, medical details, and facilitate communication with families.
In addition to the prison term, Lane has been ordered by Guzman to pay over $14 million US in restitution and a $25,000 fine, as confirmed by U.S. Attorney Leah Foley’s office. PowerSchool expressed appreciation for the efforts of law enforcement in bringing Lane to justice, while Lane’s attorney did not provide any comment.
Lane, formerly a student at Assumption University in Worcester, admitted guilt in engaging in cyber extortion, aggravated identity theft, and unauthorized access to protected computers. Prosecutors stated that Lane exploited a previous data breach at a telecommunications company in mid-2024, posing as a member of a notorious hacking group and demanding a $200,000 ransom to prevent data leakage. Subsequently, Lane used stolen login credentials to access PowerSchool’s network, enabling him to pilfer personal information of students and teachers.
Following the breach, PowerSchool received a ransom demand threatening to expose sensitive data unless a $2.85 million bitcoin payment was made. The same hacking group Lane claimed affiliation with during the telecommunications extortion incident issued the ransom demand. PowerSchool opted to pay the ransom to prevent data exposure and entrusted the hacker to delete the information. Multiple Canadian school boards later received ransom demands linked to the PowerSchool breach.