A Massachusetts student has agreed to plead guilty to federal charges relating to hacking and extorting one of the largest U.S. education tech companies, prosecutors confirmed Tuesday.
Matthew D. Lane, 19, is accused of using stolen login credentials to access the network of an unnamed software company, which serves schools across North America and elsewhere, to steal the personal information of more than 60 million students and 10 million teachers.
The stolen personal information included names, addresses, phone numbers, Social Security numbers, and medical information and school grades. In some cases, the hackers stole decades of historical student data.
While the company was not named, federal prosecutors described specific details matching the data breach at education software maker PowerSchool, which revealed in January that it had been hacked as far back as August and September 2024. The breach affected schools located mostly across the United States and Canada, which use the PowerSchool software to manage student grades, attendance, and other personal and health information.
Prosecutors say Lane worked with an unnamed co-conspirator who lived in Illinois to extort the education software maker for about $2.85 million in cryptocurrency, according to the criminal complaint.
PowerSchool confirmed to TechCrunch in January that it had paid the hackers to delete the stolen data, but refused to say how much it paid. Earlier this month, several school districts said that they had since faced extortion attempts from someone saying that the stolen student data had not been destroyed. PowerSchool said the extortion attempts were not related to a new incident, as the “samples of data match the data previously stolen in December.”
NBC News was first to report on Lane’s plea agreement.
PowerSchool spokesperson Beth Keebler said the company was aware of the filing, and deferred comment to the U.S. Attorney’s Office for Massachusetts, which did not respond to an email from TechCrunch. When asked, Keebler did not dispute the ransom amount as noted by the prosecutors.
Lane is also accused of hacking and extorting another company, which prosecutors said was a U.S. telecoms provider. Prosecutors did not name the company in the plea agreement.
Lane’s attorney Sean Smith did not respond to a request for comment.
