A 19-year-old hacker from Worcester, Massachusetts, has pleaded guilty to a massive cyberattack against PowerSchool, through which he extorted millions of dollars in exchange for not leaking the personal data of millions of students and teachers.
See also: PowerSchool hacker now blackmailing other school districts
According to the United States Department of Justice, Matthew D. Lane pleaded guilty to four federal charges: conspiracy to commit cyber extortion, cyber extortion,unauthorized access to protected computers, and identity theft.
The Department of Justice and related court documents allege that Lane and his accomplices breached a U.S.-based telecommunications company in 2022, stealing confidential customer information . During the breach, the hackers also accessed the credentials of an employee of the company, who was a contractor for PowerSchool.
Following the attempted extortion of the telecommunications company, the Department of Justice says the attackers targeted an education company, which ultimately paid the ransom. While the complaint does not specifically name PowerSchool, sources told BleepingComputer that this is the education company the Department is referring to.
According to the complaint, the perpetrator used credentials stolen from PowerSchool's external partner to breach the systems and steal data from millions of students and teachers in December 2024.
See also: PowerSchool notifies victims of data breach
Hackers breached PowerSchool's support platform, known as PowerSource, and used a maintenance tool to download the databases . The databases contained personal information for 62.4 million students and 9.5 million teachers from 6,505 school districts in the United States, Canada and other countries.
This data varied by school district and included full names of students and staff, home addresses, phone numbers, passwords, parent and contact information, social security numbers, medical data and grades.
In addition to the PowerSchool breach, the young hacker is also facing charges for attempting to blackmail the US-based telecommunications company, from which they demanded a ransom of $200,000, even threatening company executives if the amount was not paid.
Lane has agreed to plead guilty to all four charges and faces a mandatory minimum sentence of two years for identity theft, as well as sentences of up to five years for each of the remaining charges.
See also: Cyberattack on PowerSchool exposes personal data
Based on the above, the Matthew Lane case highlights serious cybersecurity issues and the vulnerability of critical digital infrastructures, such as those used in education and telecommunications. The breach of PowerSchool – one of the largest educational platforms in North America – is not just a financial crime, but a threat to the privacy and security of millions of children, families and educators.
Source: bleepingcomputer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
