US Student to Plead Guilty in Major Hack Impacting Millions of Students
A Massachusetts student is set to plead guilty to serious federal charges involving hacking and extorting one of the largest education technology companies in the U.S. This case has raised significant concerns about cybersecurity in the education sector, especially regarding the safety of personal information.
Details of the Hacking Incident
Matthew D. Lane, a 19-year-old, allegedly used stolen login credentials to infiltrate the network of a major education software firm. This breach, which affected over 60 million students and 10 million teachers, involved the theft of sensitive personal information.
Stolen Data
The compromised data included:
- Names
- Addresses
- Phone numbers
- Social Security numbers
- Medical information
- School grades
Moreover, hackers reportedly accessed decades of historical student data, heightening the stakes of this breach.
Connection to PowerSchool
Although the company involved has not been officially named, details in the case closely align with a significant data breach at PowerSchool. In January, PowerSchool disclosed that it had been hacked, with incidents tracing back to August and September 2024. The breach primarily impacted schools using their software to manage critical student data across the U.S. and Canada.
Extortion Attempts
Federal prosecutors allege that Lane collaborated with an unnamed co-conspirator from Illinois to extort approximately $2.85 million in cryptocurrency from the education software provider. PowerSchool confirmed to TechCrunch that they paid hackers to eliminate the stolen data but did not disclose the ransom amount.
Recently, several school districts reported facing new extortion attempts, indicating that the stolen student data may not have been completely destroyed. PowerSchool clarified that these attempts were linked to data previously stolen in December, not a new incident.
Legal Proceedings and Defense
Lane’s plea agreement was first reported by NBC News. PowerSchool’s spokesperson, Beth Keebler, acknowledged awareness of the legal proceedings but referred further inquiries to the U.S. Attorney’s Office for Massachusetts. As of now, there has been no comment from Lane’s attorney, Sean Smith.
Additional Hacking Charges
In addition to the allegations against PowerSchool, Lane faces charges related to hacking and extorting a U.S. telecom provider, although the specifics of this case remain undisclosed.
This incident serves as a stark reminder of the ongoing vulnerabilities in cybersecurity within the education sector. For more information on data security in education, visit EDUCAUSE.
