Teenager Who Stole the Data of 60 Million Children Just Pleaded Guilty to Cybercrime

Where most 19-year-olds are taking their first steps into adulthood in their quest to figure out who they are, 19-year-old Matthew D. Lane already knows exactly who he is

A Massachusetts teen has pleaded guilty to a federal charge of cyber extortion, aggravated identity theft, and other offenses for hacking into a cloud company and stealing the personal data of tens of millions of children.

Matthew D. Lane, 19, of North Andover, had previously pleaded not guilty to the charges in March 2024. But on Friday, he changed his plea to guilty.

According to prosecutors, Lane used stolen credentials to gain unauthorized access to a major cloud company, which is not named in court documents. However, several details in the case description and a statement from the company itself suggest that the cloud company was PowerSchool, a K-12 educational tech firm that provides software and services for schools and stores personal information for students and teachers across North America.

Prosecutors said Lane used a spear phishing attack to steal the credentials of a high-level administrator at the cloud company. He then logged into a server and used a specialized tool to extract a vast amount of data from the company’s systems.

The data included Social Security numbers, birthdays, medical records, passwords, addresses, and other sensitive information for more than 60 million children and 10 million teachers. The data also contained details of several programs used by the company, such as payroll, email, and learning management systems.

After gaining access to the data, Lane, or someone with access to the data, sent a message to a cryptocurrency news outlet, offering the data for sale and threatening to leak it online if the price was not met.

The message said that the data was available for 3 bitcoin, which was around $26,400 at the time. The contact also provided an email address for further communication.

Prosecutors said the data was stolen in 2023 and the ransom demand was made in May. The cryptocurrency news outlet contacted the FBI, who traced the email and IP address to Lane.

Agents searched his home and seized several electronic devices, including a laptop, an iPhone, and an external hard drive. They also found a copy of the ransom message on his phone.

In a statement released on Friday, the U.S. Attorney’s Office for the District of Massachusetts said Lane had committed serious cybercrimes that affected the lives of millions of people.

“This defendant engaged in a brazen scheme to steal personal data from a major cloud company and then extort ransom from the company in cryptocurrency,” said U.S. Attorney Lane. “He also stole identities and attempted to siphon funds from a telecom company. These offenses carry significant penalties and should serve as a deterrent to anyone considering similar crimes in the future.”

“This case highlights the global reach of cybercrime and the FBI’s commitment to investigating and dismantling such activity wherever it occurs,” said Special Agent in Charge Burema. “We will continue to work tirelessly with our partners to protect the public from cybercriminals who seek to do harm.”

Lane pleaded guilty to one count of aggravated identity theft, one count of cyber extortion, one count of unauthorized access to a protected computer, and one count of conspiracy to commit wire fraud.

He faces a minimum sentence of 12 years in prison and a maximum sentence of 20 years. He will also be ordered to pay restitution to the victims.

Lane is scheduled to be sentenced by U.S. District Judge Robert E. Colgan on November 1.