
A 19-year-old Massachusetts student has pleaded guilty to a massive breach of the PowerSchool system that affected more than 70 million students and teachers. The hacker demanded $2.85 million in Bitcoin and threatened to release the stolen data.
Matthew Lane, a student from Worcester, pleaded guilty to four federal crimes, including conspiracy to commit extortion, unauthorized access to a computer system, and identity theft. In 2022, he hacked a telecommunications company after obtaining PowerSchool login credentials through one of its contractors. In December 2024, Lane stole databases containing the names, passwords, Social Security numbers, health records, and grades of 62.4 million students and 9.5 million teachers from 6,505 school districts in the United States, Canada, and other countries.
After receiving the ransom, the attackers did not stop – they continued to blackmail individual schools. Some of the demands were signed by ShinyHunters, a notorious group associated with attacks on Snowflake and AT\&T. Lane also tried to extort $ 200,000 from a telecom company, threatening its management.
PowerSchool is one of the largest providers of educational software in North America. Its systems contain highly sensitive information on millions of children. The attackers hacked the PowerSource platform, where data backups were stored. The incident is another reminder of the vulnerability of the education sector, which is increasingly being targeted due to weak IT barriers.
The case highlights the dangers of accessing educational platforms — especially given that blackmail continues even after a ransom is paid. Cybersecurity in schools should be a strategic priority. Meanwhile, Lane faces a minimum of 2 years in prison, but the term can be increased to 20 years.