PowerSchool is at the center of a massive data breach that has now led to criminal charges. A 19-year-old student from Massachusetts, Matthew D. Lane, has agreed to plead guilty to hacking two companies and trying to extort millions in ransom.
Lane broke into a U.S. telecom provider in October 2022 and stole customer data. He later demanded $200,000, threatening to leak the information if the company didn’t pay.
But his biggest breach came in September 2024. Lane used stolen employee credentials to access the network of a company serving school districts across the U.S. and Canada. He stole personal data belonging to millions of students and teachers.
Investigators say Lane moved the stolen files to a server in Ukraine. Then in December, he demanded a ransom of nearly $2.85 million in Bitcoin. If unpaid, he warned, the data would be leaked online.
Although the company wasn’t named in the court filing, the timeline and scale match the massive PowerSchool hack disclosed in January 2025. PowerSchool later confirmed that personal data was taken from its Student Information System (SIS) environments.
CrowdStrike, which investigated the breach, reported that attackers used maintenance account credentials to access PowerSchool’s PowerSource portal. The portal was breached between August and September 2024. Hackers exfiltrated data from December 19 to 28. The stolen files included names, addresses, Social Security numbers, and medical records.
PowerSchool has not confirmed whether it paid the ransom. However, signs point to a payment being made. In May, the Toronto District School Board said attackers began contacting schools, claiming they had the data and demanding more money.
The Department of Justice has urged families and educators to contact their local school district if they believe a student or teacher’s data was affected.
Lane has agreed to plead guilty. He now faces a possible prison sentence and large fines.
