A Massachusetts man who breached the network of education software provider PowerSchool to steal data belonging to millions of students and teachers and extort the company was sentenced on Tuesday to four years in prison.
Matthew Lane, 20, was sentenced by U.S. District Judge Margaret Guzman in Worcester, Mass., after he pleaded guilty in June to charges related to the hacking of two companies, including California-based PowerSchool.
The breach at PowerSchool in December 2024 exposed sensitive data of more than 2.7 million current and former Canadian students, plus millions more in the U.S. Depending on what kind of information the school boards kept, data including names, birth dates, home addresses, emergency contact info and even social insurance numbers was compromised.
School systems across Canada — in Alberta, Ontario, Manitoba, Newfoundland and Labrador, Nova Scotia, Northwest Territories, Prince Edward Island and Saskatchewan — primarily use the web-based system to manage students’ personal, and sometimes medical information, grades and other details. Some use it as a portal to communicate with families.
Guzman also ordered Lane to pay more than $14 million US in restitution and a $25,000 fine, according to U.S. Attorney Leah Foley’s office.
In a statement, a spokesperson for PowerSchool said it “appreciates the efforts of the prosecutors and law enforcement who brought this individual to justice.” Lane’s attorney did not respond to a request for comment.
Some parents learned Wednesday that their children’s personal information, stolen in last December’s PowerSchool data breach, was never deleted despite the company paying a ransom. With hackers still holding millions of student records, experts urge caution.
Lane, who had been a student at Assumption University in Worcester when he was first charged, pleaded guilty in June to engaging in cyber extortion and aggravated identity theft and accessing protected computers without authorization.
According to prosecutors, in mid-2024, Lane exploited an earlier data breach at a telecommunications company and, claiming to be a member of a notorious hacking group, demanded a $200,000 ransom to avoid having the company’s data leaked. Using stolen login credentials, Lane gained access to PowerSchool’s network, allowing him to steal personal data for students and teachers, prosecutors said.
Days later, PowerSchool received a ransom demand threatening to leak the names, addresses, Social Security numbers and other sensitive data belonging to millions of students and teachers unless it paid $2.85 million worth of bitcoin, according to prosecutors.
That ransom demand came from the same hacking group Lane professed to represent when he extorted the telecommunications company, prosecutors said. PowerSchool has said it decided to pay a ransom to have the hacker delete the data and avoid having the information become public.
Multiple school boards in Canada later received ransom demands using data accessed in the PowerSchool breach.
