Teen Hacker Admits to Breaching Data of 70 Million Pupils and Teachers in Shocking US Cyberattack

A teenager from Massachusetts has pleaded guilty to one of the most devastating hacks in the US education sector's history, exposing sensitive data of more than 70 million students and educators. The unprecedented breach has reignited calls for tighter cybersecurity measures in an increasingly digitised academic world.

The 19-year-old, Matthew D. Lane, admitted to federal charges related to hacking and extorting a major US education technology company, a case that has alarmed parents, teachers and officials across North America.

The Scale of the Breach

According to TechCrunch, Lane used stolen login credentials to infiltrate the network of a yet-unnamed software provider that serves schools across the US and Canada. Prosecutors say he accessed and stole the personal details of over 60 million students and 10 million teachers.

The data included names, addresses, phone numbers, Social Security numbers, health records, and academic grades. In some cases, records dated back decades.

'Cyber extortion is a serious attack on our economy and on all of us,' said United States Attorney Leah B. Foley. 'As alleged, this defendant stole private information about millions of children and teachers, imposed substantial financial costs on his victims, and instilled fear in parents that their kids' information had been leaked into the hands of criminals – all to put a notch in his hacking belt.'

PowerSchool Named as the Likely Target

Although not explicitly identified in court, the details of the case align closely with a data breach confirmed by PowerSchool earlier this year. The company admitted in January that its systems were compromised between August and September 2024.

PowerSchool is widely used by schools across North America to manage grades, attendance, health records and personal student data.

A Ransom Demand in Cryptocurrency

Prosecutors allege Lane worked alongside an unnamed co-conspirator based in Illinois to demand a ransom of approximately $2.85 million (£2.11 million) in cryptocurrency from the affected company.

In a January statement to TechCrunch, PowerSchool confirmed that it had paid the ransom to ensure the deletion of stolen data, though it declined to specify the amount. This month, several school districts said they had received fresh threats from someone claiming the data was not erased after all.

PowerSchool said the renewed extortion attempts were not related to a new breach, noting that the 'samples of data match the data previously stolen in December.'

Official Responses and Legal Proceedings

A spokesperson for PowerSchool, Beth Keebler, acknowledged the filing but referred questions to the US Attorney's Office in Massachusetts. That office declined to name any victims, according to TechCrunch.

When asked to confirm the amount of the ransom paid, Keebler did not dispute the figure cited in court documents.

Lane also faces separate charges for hacking and attempting to extort a second company, this time a US telecommunications provider, though that firm remains unnamed in the plea agreement. Lane's attorney, Sean Smith, has not responded to media enquiries.