Student pleads guilty to PowerSchool hack, stealing 70 million student data

21 May 2025 2 minutes Author: Newsman

A 19-year-old Massachusetts student has pleaded guilty to a massive breach of the PowerSchool system that affected more than 70 million students and teachers. The hacker demanded $2.85 million in Bitcoin and threatened to release the stolen data.

Matthew Lane, a student from Worcester, pleaded guilty to four federal crimes, including conspiracy to commit extortion, unauthorized access to a computer system, and identity theft. In 2022, he hacked a telecommunications company after obtaining PowerSchool login credentials through one of its contractors. In December 2024, Lane stole databases containing the names, passwords, Social Security numbers, health records, and grades of 62.4 million students and 9.5 million teachers from 6,505 school districts in the United States, Canada, and other countries.

After receiving the ransom, the attackers did not stop – they continued to blackmail individual schools. Some of the demands were signed by ShinyHunters, a notorious group associated with attacks on Snowflake and AT\&T. Lane also tried to extort $ 200,000 from a telecom company, threatening its management.

PowerSchool is one of the largest providers of educational software in North America. Its systems contain highly sensitive information on millions of children. The attackers hacked the PowerSource platform, where data backups were stored. The incident is another reminder of the vulnerability of the education sector, which is increasingly being targeted due to weak IT barriers.

The case highlights the dangers of accessing educational platforms — especially given that blackmail continues even after a ransom is paid. Cybersecurity in schools should be a strategic priority. Meanwhile, Lane faces a minimum of 2 years in prison, but the term can be increased to 20 years.

Other related articles
News
Read more
RedisRaider is a new hacking campaign developed in Go that infects Linux servers with the XMRig cryptominer, exploiting vulnerabilities in Redis instances.
RedisRaider is a Go malware that spreads using open Redis servers on Linux. It infects the host by adding a cron` task that runs the XMRig miner for Monero. The campaign uses TTL keys and Redis configuration changes to evade detection. Protect your servers: restrict access to Redis, disable unnecessary features, and monitor for unusual activity in /etc/cron.d.
82
Found an error?
If you find an error, take a screenshot and send it to the bot.