A 19-year-old Massachusetts student has agreed to plead guilty to federal charges connected to a massive data breach that compromised the personal details of tens of millions of students and educators across North America.
Authorities say Matthew D. Lane illegally accessed the systems of a major educational software provider—whose name remains undisclosed—to steal sensitive data, including information belonging to more than 60 million students and 10 million teachers. The stolen data reportedly included full names, contact details, Social Security numbers, medical records, academic histories, and in some cases, decades of archived student information.
While prosecutors have not formally named the affected company, the incident bears strong similarities to a security breach revealed by PowerSchool earlier this year. PowerSchool, which offers widely used educational management software for schools in the U.S. and Canada, disclosed that its systems were compromised in August and September 2024.
According to the case details, Lane and a co-conspirator from Illinois demanded a cryptocurrency ransom of approximately $2.85 million in exchange for not publishing the stolen data. The complaint alleges that the hackers held the data hostage, threatening to release it if their demands were not met.
PowerSchool previously confirmed that it paid a ransom to the attackers for the deletion of the stolen data, although the exact sum was not publicly disclosed. Recently, some school districts reported receiving fresh threats from individuals claiming that the stolen data still exists and could be leaked. PowerSchool responded by saying that these extortion attempts appear to involve the same data stolen last year, not a new breach.
In addition to the education software breach, Lane is also accused of targeting a U.S. telecommunications company, though prosecutors have not identified the second victim.
NBC News was first to report on Lane’s upcoming guilty plea. When reached for comment, PowerSchool acknowledged awareness of the legal filings but referred all questions to federal prosecutors. The U.S. Attorney’s Office for Massachusetts confirmed the charges but did not name the impacted organizations.
Lane’s legal counsel has not yet issued a statement regarding the case.
