College Student Charged With PowerSchool Data Breach Affecting Millions
A 19-year-old Massachusetts college student was charged and agreed to plead guilty to hacking into software company PowerSchool's network and causing its 2024 data breach, the North Carolina Attorney General announced Wednesday. AG Jeff Jackson (D) launched an investigation into the breach that impacted more than 62.4 million people across the U.S. in February (see 2502060055).
Sign up for a free preview to unlock the rest of this article
The U.S. Attorney's Office for the District of Massachusetts announced the charges and plea agreement in a press release. The student, Matthew Lane, is charged with cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers; and aggravated identity theft, according to the press release.
Lane used stolen credentials to access PowerSchool's computer network, where he transferred the personally identifiable information (PII) of more than 60 million students and 10 million teachers to a server he leased overseas. Lane then allegedly threatened to leak the PII if PowerSchool didn't pay him a ransom of approximately $2.85 million in Bitcoin, the DOJ said. In addition to the PowerSchool hack and ransom, Lane is accused of extorting a telecommunications company with similar methods.
PowerSchool is facing lawsuits in the U.S. District Court for Eastern California for negligence that led to the data breach (see 2501220057), and in the U.S. District Court for Southern California by a Tennessee school system that alleges breach of contract and false advertising in addition to negligence (see 2505120026).
The Privacy Commissioner of Canada, Philippe Dufresne, is also investigating the breach (see 2502110031).
"As alleged, this defendant stole private information about millions of children and teachers, imposed substantial financial costs on his victims, and instilled fear in parents that their kids’ information had been leaked into the hands of criminals -- all to put a notch in his hacking belt," U.S. Attorney Leah Foley said.
"My office will continue its investigation into PowerSchool’s role in this event,” Jackson said.