Massachusetts college student to plead guilty in massive PowerSchool data breach and extortion scheme

A 19-year-old Massachusetts college student has agreed to plead guilty to federal charges stemming from a high-profile hacking incident that compromised the data of millions of students and teachers nationwide. The breach targeted PowerSchool, a widely used cloud-based education software provider, and led to an extortion campaign demanding multimillion-dollar ransoms.

Matthew Lane, a student at Assumption University in Worcester, entered into a plea agreement on Tuesday in federal court, resolving charges related to unauthorized access to computer systems, aggravated identity theft, and cyber extortion. Prosecutors say Lane infiltrated the networks of two companies—one of which has been confirmed as PowerSchool—stealing vast troves of sensitive data later used in ransom demands.

According to federal prosecutors, Lane gained access to PowerSchool’s systems in September 2024 by exploiting login credentials belonging to a contractor. He proceeded to extract student and faculty data and transferred it to a server hosted by a cloud provider in Ukraine. The stolen information included names, addresses, Social Security numbers, and other personally identifiable information tied to over 60 million students and 10 million teachers.

Just days after the data transfer, PowerSchool received a ransom demand threatening to publicly release the data unless it paid $2.85 million in bitcoin. The company, headquartered in Folsom, California, disclosed the breach in January, stating that it first became aware of the incident on December 28, 2024, and ultimately opted to pay the ransom to prevent further exposure.

U.S. Attorney Leah Foley, in a statement, said Lane’s actions “instilled fear in parents that their kids’ information had been leaked into the hands of criminals – all to put a notch in his hacking belt.” Lane’s legal counsel has not issued a public response.

The breach marked the first time federal authorities had identified an individual linked to the cyberattack on PowerSchool, whose platform supports over 18,000 schools and more than 60 million students across the United States. In addition to the primary ransom demand sent to PowerSchool, multiple school districts have reportedly received separate extortion attempts related to the same data breach.

Before the PowerSchool attack, Lane and unnamed co-conspirators allegedly attempted to extort a telecommunications company, demanding $200,000 in exchange for withholding data previously stolen from its network. Under the terms of the plea deal, Lane will plead guilty to cyber extortion, aggravated identity theft, and unauthorized access to protected computers. He faces a mandatory minimum sentence of two years in federal prison.