Massachusetts man will plead guilty in PowerSchool hack case

It’s the first public break in the case that might be the largest breach of American schoolchildren's data.

A Massachusetts man will plead guilty to charges related to the hack of PowerSchool, the education software vendor that says it supports more than 60 million students, and that led to ransom demands at school boards and districts across the United States.

In court documents filed Tuesday, prosecutors spelled out charges against 19-year-old Assumption University student Matthew Lane and the terms of a plea bargain. While prosecutors didn’t name a victim firm, the description of the company matches that of PowerSchool.  A source confirmed to CyberScoop that PowerSchool was one of the victims in Lane’s case.

It’s the first big break in a case that has been said to be the largest single breach ever of American schoolchildren’s data. 

According to documents filed Tuesday, Lane and an unnamed co-conspirator obtained stolen victim data from a U.S. telecommunications company, which is not identified in the filings.  When the first victim refused to pay a $75,000 ransom, Lane allegedly messaged the co-conspirator, saying  “we need to hack another … company [that’ll] pay.”  The documents state that in September, Lane used a PowerSchool contractor’s credentials to gain unauthorized access to PowerSchool’s networks, where he obtained student and teacher data.

A ransom demand followed in December, according to the documents. PowerSchool said it paid the ransom, but didn’t give the figure. Court documents say that the ransom demand threatened to release sensitive data on 10 million teachers and 60 million students if PowerSchool didn’t pay an amount of Bitcoin then worth nearly $2.9 million.

Last week a New York school district said the State Education Department’s chief privacy officer notified officials there that the group responsible for the attack went by the name “Shiny Hunters.” A source familiar with the incident told CyberScoop that Lane was affiliated with the outfit.

ShinyHunters is a cybercriminal group that emerged in April 2020 and has since been tied to several high-profile data breaches, including Microsoft’s GitHub, photo editing app Pixlr, clothing retailer Bonobos and telecom giant AT&T.  

Lane will plead guilty to three of the four charges prosecutors had leveled at him: threatening to impair the confidentiality of information obtained from a protected computer without authorization and aiding and abetting; accessing a protected computer without authorization and aiding and abetting; and aggravated identity theft. 

An attorney for Lane did not immediately respond to a message seeking comment Tuesday.

Federal authorities celebrated the outcome.

“Matthew Lane apparently thought he found a way to get rich quick, but this 19-year-old now stands accused of hiding behind his keyboard to gain unauthorized access to an education software provider to obtain sensitive data which was used in an attempt to extort millions of dollars. He also allegedly conspired to extort more money from a telecommunications provider over its confidential data,” said Kimberly Milka, acting special agent in charge of the Federal Bureau of Investigation’s Boston division. “This alleged scheme has resulted in serious consequences and highlights the FBI’s ongoing commitment to bringing cyber criminals to justice, no matter what their motivation is for willfully breaking the law.”

Matt Kapko and Greg Otto contributed reporting for this story.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure