PowerSchool hacker sentenced to four years for data theft, extortion

New York [US], October 15: A Massachusetts man who breached the network of education software provider PowerSchool to steal data belonging to millions of students and teachers and extort the company was sentenced on Tuesday to four years in prison.
Matthew Lane, 20, was sentenced by U.S. District Judge Margaret Guzman in Worcester, Massachusetts, after he pleaded guilty in June to charges related to the hacking of two companies, including Folsom, California-based PowerSchool.
The breach at PowerSchool exposed sensitive data of more than 60 million students and 10 million teachers nationwide. It occurred in December, a month before the company publicly disclosed the breach.
Guzman also ordered Lane to pay more than $14 million in restitution and a $25,000 fine, according to U.S. Attorney Leah Foley's office.
A spokesperson for PowerSchool in a statement said it "appreciates the efforts of the prosecutors and law enforcement who brought this individual to justice." Lane's attorney did not respond to a request for comment.
Lane, who had been a student at Assumption University in Worcester when he was first charged, pleaded guilty in June to engaging in cyber extortion and aggravated identity theft and accessing protected computers without authorization.
According to prosecutors, opens new tab, in mid-2024, Lane exploited an earlier data breach at a telecommunications company and, claiming to be a member of a notorious hacking group, demanded it pay a $200,000 ransom to avoid having its data leaked.
Using stolen login credentials, he gained access to PowerSchool's network, allowing him to steal personal data for students and teachers, prosecutors said.
Days later, PowerSchool received a ransom demand threatening to leak the names, addresses, Social Security numbers and other sensitive data belonging to more than 60 million students and 10 million teachers unless it paid $2.85 million worth of bitcoin, according to prosecutors.
That ransom demand came from the same hacking group Lane professed to represent when he extorted the telecommunications company, prosecutors said. PowerSchool has said it decided to pay a ransom to avoid having the information become public.
Source: Fijian Broadcasting Corporation