United States and Canada: 19-Year-Old Student Pleads Guilty to PowerSchool Hack

The theft of personal data from millions of students and teachers led to multiple ransom demands.

Matthew Lane, a 19-year-old student from Massachusetts, pleaded guilty in U.S. court on May 20, 2025, to hacking the educational software provider PowerSchool. The legal document references two data theft cases; while victims are unnamed, consistent clues and a source close to the case confirm that the second victim is PowerSchool.

PowerSchool serves over 18,000 schools, primarily in the U.S. and Canada, covering more than 60 million students and 9 million teachers. Prosecutors say Matthew Lane accessed PowerSchool’s IT systems in September 2024 using credentials from a company subcontractor. He exfiltrated personal data of all users and copied it to a server in Ukraine.

On December 28, 2024, Lane notified PowerSchool of the breach, demanding a ransom of $2.85 million (2.5 million euros). The company agreed to pay and publicly disclosed the hack in January 2025. Several school boards, including in Canada, subsequently received further ransom demands linked to the data leak.

Matthew Lane faces charges of cyber extortion, aggravated identity theft, and unauthorized access to protected computers. He faces a minimum prison sentence of two years.