BOSTON, Mass. (AP) — A Massachusetts college student will plead guilty to stealing millions of students' and teachers' private data from two U.S. education tech companies and extorting it for ransom, the U.S. attorney's office said.
Assumption University student Matthew Lane, 19, is accused of using stolen login credentials to access the computer network of a software and cloud storage company serving school systems in the U.S. and abroad, according to U.S. Attorney for the District of Massachusetts Leah B. Foley.
PowerSchool was not named in the court filings, but North Carolina Attorney General Jeff Jackson confirmed the connection.
"The U.S. Department of Justice charged 19-year-old Massachusetts college student Matthew Lane with hacking PowerSchool’s system and facilitating the 2024 data breach that potentially exposed the private information of millions of North Carolina teachers, students, and parents," the attorney general's office said in a news release.
North Carolina public schools use the software to manage data of more than 1.5 million students and almost 100,000 teachers. It can track student attendance, transcripts and contact information.
PowerSchool in January reported a data breach that took place in late December.
North Carolina's attorney general in February began investigating to determine whether the company broke any laws leading to the security breach.
“This hacker compromised the personal data of millions of people in our state and I’m glad to see he is being brought to justice,” Jackson said in a news release. “My office will continue its investigation into PowerSchool’s role in this event."
North Carolina public school employees this month reported getting threatening emails in connection with the data breach. State education officials said staff at about 20 agencies received demands for payment in Bitcoin.
Lane is pleading guilty to cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers and aggravated identity theft.
According to court records, Lane is alleged to have threatened the release of 60 million students' and 10 million teachers' names, phone numbers, Social Security numbers, residential addresses and medical histories if the company did not pay a ransom of $2.85 million in Bitcoin.
Foley said Lane’s actions “instilled fear in parents that their kids’ information had been leaked into the hands of criminals — all to put a notch in his hacking belt.”
An attorney representing Lane couldn't be reached to comment Wednesday. Lane, of Sterling, Mass., faces counts of cyber extortion conspiracy, cyber extortion and unauthorized access to protected computers and aggravated identity theft. A plea hearing has not been scheduled.
Lane is also accused of extorting a $200,000 ransom payment from another telecommunications company last spring by threatening to release customer data.
“Matthew Lane apparently thought he found a way to get rich quick, but this 19-year-old now stands accused of hiding behind his keyboard to gain unauthorized access to an education software provider to obtain sensitive data which was used in an attempt to extort millions of dollars,” said Kimberly Milka, acting special agent in charge of the Federal Bureau of Investigation, Boston Division.