A 19-year-old college student, Matthew D. Lane from Worcester, Massachusetts, has been sentenced to four years in prison for orchestrating a major cyberattack on PowerSchool in December 2024 that led to a massive data breach.
According to the U.S. Department of Justice, Lane and his accomplices used stolen credentials from a subcontractor to gain access to PowerSchool’s internal systems. They breached the company’s PowerSource customer support portal, stealing databases containing sensitive information of 9.5 million teachers and 62.4 million students from 6,505 school districts worldwide.
The stolen data included names, addresses, phone numbers, passwords, Social Security numbers, and medical details. The attackers demanded a $2.85 million ransom in Bitcoin, claiming to be part of the Shiny Hunters group known for major data breaches involving AT&T, SnowFlake, and Salesforce. Despite PowerSchool reportedly paying a ransom, the hackers continued to demand payments from individual school districts.
Lane pleaded guilty in May 2025 to multiple federal charges, including unauthorized access, cyber extortion, and aggravated identity theft. He was ordered to pay $14 million in restitution and a $25,000 fine.
Meanwhile, PowerSchool faces ongoing legal action, including a lawsuit from the Texas Attorney General over alleged failures to protect student data.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
