Teen Hacker Behind Massive Education Data Breach Sentenced to Prison A 20-year-old hacker, Matthew Lane, has been sentenced to four years in prison for orchestrating one of the largest education data breaches in history. Lane, who began hacking at 15, infiltrated PowerSchool a California-based software provider serving over 18,000 school districts worldwide using stolen employee credentials in 2024. He exfiltrated sensitive data, including Social Security numbers, birth dates, and medical records, transferring it to a server in Ukraine before demanding a $2.8 million Bitcoin ransom. PowerSchool paid an undisclosed sum to prevent the leak of data belonging to an estimated 60 million students and 10 million teachers across the U.S., Canada, and other countries. The breach impacted several San Diego County school districts, including Rancho Santa Fe, Ramona Unified, and Santee, though San Diego Unified later confirmed its data was unaffected. Lane, who has autism, described hacking as an addiction, driven by the thrill and financial rewards. He used ransom proceeds to fund a lavish lifestyle, including a penthouse and designer goods. Arrested by the FBI in his Massachusetts dorm room at 19, he expressed relief at being caught, stating he would have continued otherwise. A judge ordered him to pay over $14 million in restitution. FBI Supervisory Special Agent Doug Domin called the PowerSchool hack one of the worst he’d seen, noting investigators traced the breach through financial transactions. Experts, including Fergus Hay of The Hacking Games, highlighted that many cybercriminals are young, neurodivergent individuals drawn to hacking through gaming communities, where pattern recognition and rule-breaking skills translate into cybercrime. PowerSchool, which offered affected individuals two years of free credit monitoring, emphasized its commitment to data security but did not disclose the total number of victims. The case underscores the growing threat of juvenile hackers exploiting vulnerabilities in critical systems.

The California Office of the Attorney General reported that the Santee School District experienced a data breach involving its Student Information System vendor, PowerSchool, from December 19 to December 23, 2024. The breach resulted in unauthorized access to some student and staff data, although no social security numbers were affected. The report was made on January 13, 2025.