College Student Behind PowerSchool Data Breach

By Gordon Hopkins A 19-year-old college student has agreed to plead guilty to a data breach that threatened to expose the personal data of as many as 60 million students and 10 million teachers.The victim is not named in court documents but, was described as “a software and cloud storage company that served school systems in the United States, Canada, and elsewhere.” However, a number of news outlets have quoted sources familiar with the incident that the victim was PowerSchool, an education software company that provides the Student Information System (SIS) used by more than 18,000 schools around the world, including many local school districts here in Nebraska.FJN reached out to PowerSchool. The company would not confirm if they were the victim but said only, “We are aware of the filing. Please contact the U.S. Attorney’s Office for further information.”SuspectThe suspect is Matthew D. Lane, a student at Assumption University in Worcester, Massachusetts. A second suspect is unnamed but described in court documents as a co-conspirator who lived in Illinois. Court documents also refer to other “co-conspirators known and unknown to the U.S. Attorney” but provide no details.In accordance with the plea agreement, Lane has agreed to plead guilty to cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers, and aggravated identity theft. Each charge carries a possible penalty of up to five years in prison, three years of supervised release and a fine of up to $250,000, or twice the gross gain or loss, whichever is greater. The charge of aggravated identity theft provides for a mandatory minimum sentence of two years in prison, consecutive to any sentence imposed on the computer fraud charges.A plea hearing has not yet been scheduled by the Court.In a statement, United States Attorney Leah B. Foley said, “Cyber extortion is a serious attack on our economy and on all of us. As alleged, this defendant stole private information about millions of children and teachers, imposed substantial financial costs on his victims, and instilled fear in parents that their kids’ information had been leaked into the hands of criminals – all to put a notch in his hacking belt. The alleged ransoms that this defendant and others like him demand hurt victim companies and their innocent customers whose data the companies are entrusted to hold.” “Matthew Lane apparently thought he found a way to get rich quick, but this 19-year-old now stands accused of hiding behind his keyboard to gain unauthorized access to an education software provider to obtain sensitive data which was used in an attempt to extort millions of dollars. He also allegedly conspired to extort more money from a telecommunications provider over its confidential data,” said Kimberly Milka, Acting Special Agent in Charge of the Federal Bureau of Investigation (FBI), Boston Division. “This alleged scheme has resulted in serious consequences and highlights the FBI’s ongoing commitment to bringing cyber criminals to justice, no matter what their motivation is for willfully breaking the law.”TimelineAnother victim is also named in court documents. That victim is also not named but was identified as “a U.S.-based telecommunications company.”According to court filings, between April 2024 and May 2024, Lane and co-conspirator allegedly conspired to extort a $200,000 ransom payment from a telecommunications company by threatening to publicly disseminate customer data that had previously been stolen from the company’s computer network.On or about April 22, 2024, Lane used an anonymized email address to contact the victim and demanded a ransom of $200,000 in Bitcoin, a type of digital currency, in exchange for not leaking the stolen data.When the victim company questioned whether a ransom payment would in fact end the threat of its customer data being leaked, Lane allegedly responded, “We are the only ones with a copy of this data now. Stop this nonsense [or] your executives and employees will see the same fate . . . . Make the correct decision and pay the ransom. If you keep stalling, it will be leaked.”After the victim refused to pay, LANE messaged his co-conspirator, “we need to hack another. . . company that[’]ll pay.”That was when Lane and his co-conspirator allegedly targeted PowerSchool.Per court filings, Lane accessed PowerSchool's network using an employee's credentials on September 4, 2024.On December 19, 2024, Lane allegedly leased a computer server from a cloud storage provider located in Ukraine and, the next day, transferred data stolen from PowerSchool to that server.On December 28, 2024, PowerSchool received a ransom demand, which threatened to “leak . . . worldwide” the names, email addresses, phone numbers, Social Security numbers, dates of birth, medical information, residential addresses, parent and guardian information, and passwords, among other data, if he was not sent approximately $2.85 million in Bitcoin to a specific Bitcoin address.

New Construction in Wymore

Tri County Superintendent Announces Retirement

Related Articles

Nebraska Wildfires Nearing Containment, But Danger Remains

Data Centers and Energy Needs Create Controversy

EPA Approves Summer E15 Sales

Plan ‘C’ for Compromise: Nebraska Lawmakers Advance Budget Bills to Final Debate After Gridlock