The PowerSchool Hacker, 20-year-old Matthew Lane, was sentenced in federal court Tuesday to four years in prison and ordered to pay over $14 million in restitution. He was convicted of orchestrating one of the largest education-related data breaches in history.

Lane, a former Assumption University freshman, carried out a cyberattack that compromised the sensitive information of more than 60 million students and 10 million educators across North America.

According to federal prosecutors, Lane was a “sophisticated and experienced cybercriminal” who hacked into PowerSchool, a major education technology company that provides student information systems to schools and districts across the U.S. and Canada.

Read the company’s official statement here: SIS Incident | PowerSchool

Largest Exposure of Student Data in History

In December 2024, Lane breached PowerSchool’s systems and transferred the stolen records to a leased server in Ukraine. Prosecutors said that three months later, the company received a ransom demand of $2.85 million in Bitcoin, threatening to “destroy your company and bankrupt it to the point of no absolute return” if payment was not made.

The attack — which PowerSchool said affected a subset of institutions using its Student Information System (SIS) — exposed personally identifiable information (PII), including the Social Security numbers of children as young as five. While not all districts were impacted, the scale of the breach made it one of the most significant cyberattacks in education history.

Lane pleaded guilty in June to cyber extortion conspiracy, unauthorized access to protected computers, and aggravated identity theft.

PowerSchool data breach: Explaining how it happened

PowerSchool Hacker: “Thankful I Got Caught”

During sentencing before U.S. District Judge Margaret Guzman, Lane appeared remorseful, admitting, “I robbed actual people and their families of their sense of security … I deserve to be punished.” He added that his crimes took place during an “extremely dark time in my life,” and that he has since become “sober not just from drugs, but from the internet as well.”

A New Big Bang Model: Scientists Propose Another Explanation for the Universe’s Origins - USA Herald

Lane broke down in tears upon learning his sentence, which includes three years of supervised release and a $25,000 fine.

Judge Guzman acknowledged Lane’s young age but stressed that his case highlights the dangers of modern technology and youth access to it. “Parents have placed computers in their children’s bedrooms and provided cell phones to grade schoolers without proper guardrails,” she said. “Lane won’t be the last one to exhibit bravado behind the screen of a computer.”

PowerSchool Hacker ‘Thankful I Got Caught,’ Sentenced to 4 Years in Prison

Cybercrime and Accountability

Federal prosecutors argued that Lane’s actions were motivated by greed, pointing to earlier crimes, including an extortion attempt against a U.S.-based telecommunications company. In a sentencing memo, they described him as “calculating” and “dangerous,” noting that the PowerSchool breach was “not an impulsive act but a deliberate campaign.”

While Judge Guzman showed leniency due to Lane’s age and expressed hope for his rehabilitation, she emphasized the seriousness of his actions. “This should serve as a cautionary tale,” she said. “The reach of technology today makes it easier than ever to cause harm on a global scale.”