19-Year-Old to Plead Guilty to Hacking Charges After Data Breach of Millions of Schoolchildren

Gizmodo

21-05-2025

A Massachusetts teenager has pled guilty to a number of hacking crimes, including his role in the penetration of a cloud company with data on tens of millions of children, the government says.
On Wednesday, the Justice Department said that 19-year-old Matthew D. Lane of Sterling, Massachusetts, had entered into a plea agreement with the government for his role in a number of high-profile hacking episodes. The former college student pled guilty to aggravated identity theft, as well as other crimes. Lane's plea agreement and a criminal complaint against him were posted to the Justice Department's website, along with additional information about the teen's criminal antics.
Lane is accused of personally hacking a company using leaked employee credentials. While this company hasn't been named in court documents, NBC has reported that the victim is PowerSchool, a cloud and analytics provider that says it services K-12 schools across North America. NBC describes it as 'one of the top tech education companies' in the country. Lane's compromise of it last year led to the theft of data on tens of millions of children. The information that Lane stole included the 'Social Security numbers, dates of birth, and confidential medical information, among other data, of the students and faculty' sourced from the company's network.
Not long after Lane stole the data, the company received an extortion message, the government says. That message threatened to 'leak . . . worldwide' the 'names, email addresses, phone numbers, Social Security numbers, dates of birth, medical information, residential addresses, parent and guardian information, and passwords, among other data, of more than 60 million students and 10 million teachers if Victim 2 did not send 30 Bitcoin (approximately $2.85 million at the time) to a specific Bitcoin address,' federal prosecutors wrote. Gizmodo reached out to PowerSchool for comment.
According to the Justice Department, Lane was also part of a criminal group that stole data from a telecommunications firm and then sought to extort the company for $200,000. It is unknown who actually hacked the telecom, though Lane is said to have used an anonymous email to contact the telecom directly, telling it to fork over the ransom in Bitcoin or suffer a humiliating data breach. Lane purportedly said: 'We are the only ones with a copy of this data now. Stop this nonsense [or] your executives and employees will see the same fate . . . . Make the correct decision and pay the ransom. If you keep stalling, it will be leaked.'
'Matthew Lane apparently thought he found a way to get rich quick, but this 19-year-old now stands accused of hiding behind his keyboard to gain unauthorized access to an education software provider to obtain sensitive data which was used in an attempt to extort millions of dollars,' said FBI official Kimberly Milka.