Former College Student Sentenced for Massive PowerSchool Cyberattack

WORCESTER, Massachusetts — Matthew Lane, a former college student, has been sentenced to four years in prison following a massive cyberattack on the education technology company PowerSchool. The sentencing took place in federal court on Tuesday, where Lane was also ordered to pay more than $14 million in restitution.

Lane, who was just a teenager at the time of the attack, described himself as a sophisticated hacker and admitted that his crimes occurred during an “extremely dark time” in his life. He told U.S. District Court Judge Margaret Guzman, “I deserve to be punished,” acknowledging the impact of his actions on millions of individuals.

In June, Lane pleaded guilty to the breach, which compromised private data of approximately 60 million students and 10 million educators. Lane reflected on his actions, stating, “I robbed actual people and their families of their sense of security.” Now 20 years old, he expressed gratitude for being caught, as it led him to take responsibility for his actions.

Lane’s crimes included cyber extortion and identity theft. Federal prosecutors initially sought a seven-year sentence, citing the severity of his actions that threatened to bankrupt PowerSchool unless a ransom of $2.85 million in Bitcoin was paid. His hacking exploits began in September 2024, which resulted in an extortion demand sent to PowerSchool operators three months later.

During the court hearing, Lane broke down in tears as the sentence was announced, which included three years of supervised release and a $25,000 fine. His criminal activities involved not only the attack on PowerSchool but also a separate extortion case with a U.S.-based telecommunications firm in Illinois.

Judge Guzman, while sympathetic to Lane’s age, warned of the dangers of technology misuse. She emphasized the need for parents to monitor their children’s online activities, stating that Lane’s story serves as a cautionary tale amidst the technological age’s complexities.

Lane’s defense attorney argued for a lighter sentence, pointing to his youth and lack of a criminal record. Support letters presented to the court characterized Lane as a caring individual who struggled with mental health issues including loneliness and depression. However, Assistant U.S. Attorney Kristen Kearney labeled Lane’s behavior as calculated and motivated by greed.

Despite returning around $160,000 of the stolen funds, approximately $3 million remains unaccounted for. The federal investigation revealed numerous previous cyberattacks tied to Lane going back to 2021, indicating a pattern of criminal behavior.

PowerSchool expressed appreciation for law enforcement’s efforts to address the breach. “We remain focused on supporting our school partners and safeguarding student, family, and educator data,” the company said in a statement following the sentencing.

As Lane prepared to leave the courtroom, he met with friends and family, expressing his love for them as they exchanged heartfelt hugs and goodbyes.