A 19-year-old college student from Massachusetts has agreed to plead guilty to hacking cloud-based education software provider PowerSchool, stealing sensitive data belonging to tens of millions of students and teachers, and participating in a ransomware extortion scheme.
Matthew Lane, a student at Assumption University, was charged in federal court in Worcester, Massachusetts, for unauthorized access to protected computers, aggravated identity theft, and cyber extortion. Prosecutors say Lane accessed PowerSchool’s network using credentials stolen from a contractor in September 2024, and transferred massive amounts of data to a remote server in Ukraine.
The breach, which PowerSchool disclosed in January 2025, reportedly compromised the names, addresses, Social Security numbers, and other personal information of over 60 million students and 10 million educators. Prosecutors say the stolen data was used to demand a $2.85 million ransom in bitcoin from PowerSchool to prevent public disclosure.
U.S. Attorney Leah Foley stated that Lane’s actions “instilled fear in parents that their kids’ information had been leaked into the hands of criminals – all to put a notch in his hacking belt.”
In addition to the PowerSchool breach, Lane is also accused of targeting an unnamed telecommunications company in a separate $200,000 ransomware scheme. He now faces at least two years in prison under his plea agreement.
PowerSchool, based in Folsom, California, serves over 18,000 schools and supports more than 60 million students worldwide.
