College Student to Plead Guilty to Hacking PowerSchool

A teenage college student plans to plead guilty to extorting K-12 student information system platform provider PowerSchool after being accused of stealing data pertaining to millions of students and faculty.

See Also: Top 10 Technical Predictions for 2025

U.S. prosecutors last week unveiled hacking, extortion and identity theft charges against Massachusetts-based Matthew D. Lane, 19, together with an agreement he signed Tuesday, pledging to plead guilty to multiple charges.

Prosecutors said Lane is a student at Assumption University, a Roman Catholic university based in Worcester, Massachusetts. The charges against him carry a maximum sentence of 17 years in prison. The court has yet to schedule a date to hear the defendant’s change of plea.

His attorney didn’t immediately respond to a request for comment.

The charges against Lane pertain to attacks against two different organizations: a U.S. telecommunications firm, as well as “a software and cloud storage company that served school systems in the United States, Canada and elsewhere.” While prosecutors named neither victim, the details and timing pertaining to the second victim are an exact match with the attack against Folsom, California-based PowerSchool.

The PowerSchool breach resulted in the theft of information from schools in the U.S., Canada as well as the self-governing British overseas territory Bermuda.

PowerSchool’s platform stores information pertaining to about 60 million K-12 students and teachers across more than 18,000 customers – including over 90 of the top 100 U.S. districts, based on student enrollment numbers. As Bleeping Computer first reported, the attacker claimed to have stolen personal data pertaining to 62.4 million students and 9.5 million teachers, although that claim couldn’t be verified.

Lane also stands accused of demanding 30 bitcoins, worth approximately $2.85 million at the time, from PowerSchool in return for a promise to not leak stolen data.

“This defendant stole private information about millions of children and teachers, imposed substantial financial costs on his victims, and instilled fear in parents that their kids’ information had been leaked into the hands of criminals – all to put a notch in his hacking belt,” said Leah B. Foley, the U.S. Attorney for Massachusetts.

Earlier this month, someone began using the stolen data to directly extort affected schools, leading PowerSchool to state publicly that it paid a post-attack ransom – the amount hasn’t been disclosed – to try and prevent this outcome (see: No Fairy Tale Ending: PowerSchool’s Hacker Targets Customers).

Stolen Credentials Tied to Breach

PowerSchool first began warning schools and districts on Jan. 8 that a hacker had breached its network the prior month. The company, which was acquired by Bain Capital for $5.6 billion in a deal that closed last October, taking it private, immediately hired incident response firm CrowdStrike to investigate, and later published its final incident report.

According to court documents, in September 2024, Lane used stolen login credentials assigned to a contractor who worked for PowerSchool to access its network and steal student and faulty data. On Dec. 19, 2024, he leased space from a Ukraine-based cloud storage provider, and the next day exfiltrated names, dates of birth, confidential medical information, Social Security numbers and other information pertaining to students and faculty being stored by PowerSchool.

Extortion quickly followed, with PowerSchool on Dec. 28, 2024, receiving a demand for 30 bitcoins unless it wanted to see the stolen information get leaked, according to court documents.

PowerSchool didn’t immediately respond to a request for comment about the charges against Lane, although in a statement to The Record, said that while it can’t comment on active cases, it remains “focused on working through this matter directly with our customers” as well as “committed to serving” students, teachers and faculty.

At least 23 lawsuits seeking class-action status have been filed against PowerSchool over the breach.

Telecom Victim

Prosecutors also charged Lane, together with an unnamed co-conspirator based in Illinois as well as “others known and unknown to the U.S. attorney,” with obtaining sensitive customer information originally stolen in October 2022 from a U.S.-based telecommunications firm. Around April 2024, the suspects used the data to try and extort $200,000 from the firm, later reduced to $75,000, in return for a promise to not leak the data, according to court documents.

In negotiations with the victim, when asked what guarantees any ransom payment would provide, according to court documents, Lane responded, “We are the only ones with a copy of this data now. Stop this nonsense [or] your executives and employees will see the same fate. … Make the correct decision and pay the ransom. If you keep stalling, it will be leaked.”

Prosecutors said Lane and his co-conspirator used the encrypted Signal messaging app to communicate with each other when coordinating their shakedown.

Plea Agreement

Lane’s plea agreement states that he will plead guilty to cyber extortion conspiracy, cyber extortion, unauthorized access and aggravated identity theft charges tied to hacking the two different victims.

The charges against Lane each carry a sentence of up to five years in prison, except for aggravated identity theft, which imposes a mandatory two-year sentence to be served consecutively to the computer crime charges. Final determination of any sentence to be served gets made by a federal district court judge.

Under the terms of his plea agreement, Lane will agree to not challenge any sentence imposed by a judge that amounts to 9 years and three months’ incarceration, or less. He will also admit to controlling 12 Monero – aka XMR – wallet addresses tied to the attacks and agree to forfeit them, together with an additional $160,981 in assets and whatever further restitution a judge might order.