PowerSchool Hacker, 20, Gets 4 Years in Federal Prison
Matthew Lane was 19 when FBI agents knocked on his dorm room door. He is now serving four years in federal prison for a breach of education software company PowerSchool that the Justice Department said put the data of 60 million children and 10 million teachers at risk. In an interview published by ABC News in April 2026, Lane described himself as addicted to hacking. abcnews
Key facts
Who: Matthew Lane, now 20, of Massachusetts
The breach: PowerSchool, used by 80% of school districts in North America, breached in late 2024 using credentials stolen from a contractor
Impact: The Justice Department said the breach put at risk the data of 60 million children and 10 million teachers
Outcome: Lane pleaded guilty in June 2025 and was sentenced in November to four years in prison and more than $14 million in restitution
Note: This account is based on ABC News reporting published April 14, 2026
How did the PowerSchool breach happen?
Credentials stolen from a PowerSchool contractor were available online in the fall of 2024. According to court documents, Lane used them to move through PowerSchool's systems undetected and leased a server in Ukraine, where an alleged co-conspirator transferred large volumes of student and teacher data.
In late December, PowerSchool received threatening messages demanding nearly $3 million in cryptocurrency and claiming to come from a global cybercrime syndicate. PowerSchool paid, later calling it a very difficult decision made to keep the data from becoming public.
That payment did not end it. A week after the FBI searched Lane's dorm room, school districts in North Carolina and Canada began receiving fresh extortion messages using the same stolen data. A rogue actor tied to the original breach had kept a copy, despite assurances the data would be deleted.
Why does this case matter beyond one defendant?
Because of what it says about who is committing these attacks. FBI Supervisory Special Agent Doug Domin, who oversaw the PowerSchool investigation from the bureau's Boston field office, said investigators have interviewed subjects as young as 14.
Lane traced his own path to the gaming platform Roblox around age nine or ten, where curiosity about game cheating led him to hacking forums. Those forums, he said, offered both technical knowledge and a sense of camaraderie, alongside displays of cash and luxury goods that made the lifestyle look attainable.
Other recent cases follow the pattern. An Illinois teenager was arrested over a 2023 attack on Las Vegas casinos, allegedly launched at age 15, that reportedly cost MGM Resorts more than $100 million. A 19-year-old British national was arrested overseas for allegedly helping a cybergang extort $115 million starting at age 16.
The lasting cost
Domin said those affected by the original breach will be managing the consequences permanently, because the dataset resurfaces and re-victimizes people each time it circulates. Children's records are especially damaging in this respect — a Social Security number issued at birth cannot be reset, and the child may not discover the misuse for years.
PowerSchool offered two years of credit monitoring and identity protection to affected customers.
For parents, the practical takeaway is unglamorous: freeze your children's credit, and treat school-related breach notices as a trigger to do so rather than a formality.
Source: ABC News, published April 14, 2026.