Perpetrator of Powerschool student hack to plead guilty

A 19-year-old U.S. student agreed to plead guilty to using stolen login credentials to access the network of an unspecified software company to steal the personal information of 60 million students and 10 million teachers.

Prosecutors didn’t name the specific hack in a release, but the details they did share match a 2024 hack of PowerSchool software that affected students and teachers in Canada and the U.S.

The release notes that 19-year-old Matthew Lane was charged in connection with hacking into two companies’ computer networks and extorting those companies. Lane agreed to plead guilty to one count each of cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers, and aggravated identity theft.

The release says that Lane had one co-conspirator, and they worked together to extort PowerSchool for US$2.85 million (roughly, C$3.94 million CAD) in cryptocurrency. PowerSchool told TechCrunch that it paid the hackers to ensure the stolen data would be deleted.

In early May, a number of schools still reported that they had also received extortion attempts from people claiming to have access to the allegedly deleted data. PowerSchool confirmed that the leaked data matches what was in the original hack.

In January, the Torondo District School Board said that the data breach may impact some students as far back as 1985. It also clarified that it doesn’t store social security numbers or financial information. However, personal information like date of birth, medical history, address, and more was impacted.

The data breach also affected twenty other Ontario school boards, as well as those in Alberta, Newfoundland and Labrador, Nova Scotia, Prince Edward Island, Manitoba, and the Northwest Territories.

None of the allegations have yet been proven in a court of law.

Image credit: Shutterstock

Source: TechCrunch, CBC News