Four-Year Prison Sentence for PowerSchool Hacker

A Massachusetts college student was sentenced to four years in prison for hacking and extorting two companies, including PowerSchool. Matthew D. Lane pleaded guilty in May to hacking into the networks of a telecommunications service provider and another company, and to extorting roughly $3 million from them.

Documents shown in court indicated that, between April 2024 and May 2024, Lane and his co-conspirators extorted about $200,000 from the telecoms firm, threatening to leak customer information stolen from its network in 2022. Lane also used stolen credentials to access a company that provides software and cloud storage to school systems, with further access in September 2024 and December 2024 during which student and teacher data were exfiltrated.

The attackers stole names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, medical information and other data, and demanded a $2.85 million ransom in Bitcoin to prevent the leak, an event linked to the PowerSchool hack that affected roughly 70 million individuals.

PowerSchool in May confirmed paying a ransom to prevent the data leak, but the attackers did not delete the stolen information and then extorted school districts in the US and Canada; Lane has since returned about $160,000, with most of the $3 million remaining unaccounted for. He was sentenced to four years in prison and three years of supervised release, and ordered to pay $14 million in restitution and a $25,000 fine, according to PowerSchool.