Overview

• Matthew Lane, a 19-year-old from Massachusetts, pleaded guilty to cyber extortion, aggravated identity theft, and unauthorized computer access in federal court on May 20, 2025.
• Lane accessed PowerSchool's network using stolen contractor credentials and transferred sensitive data to a server in Ukraine.
• The stolen data included names, addresses, Social Security numbers, and other personal information for over 60 million students and 10 million teachers, making it the largest known breach of U.S. children's data.
• PowerSchool paid a $2.85 million bitcoin ransom in December 2024 to prevent public disclosure of the data, though districts continue to face related extortion attempts.
• Lane faces a minimum of two years in prison, while prosecutors continue investigating co-conspirators involved in the hacking and extortion schemes.