20-Year-Old Enters Prison for Historic Breach, Ransoming of Massive Student Database

Source: Slashdot

Background

20‑year‑old Matthew Lane sent a text message to ABC News while his parents drove him to a federal prison in Connecticut. “I’m just scared,” he said, describing the situation as “extremely sad.”

Barely a year earlier, while still a teenager, Lane helped launch what has been described as the biggest cyberattack in U.S. education history. The breach targeted the education‑technology company PowerSchool, which serves about 80 % of school districts in North America and operates in roughly 90 countries.

The attackers threatened to expose social security numbers, dates of birth, family information, grades, and confidential medical data. Under pressure, PowerSchool paid a multi‑million‑dollar ransom.

Arrest and Sentencing

In an exclusive ABC News interview, Lane said, “I think I need to go to prison for what I did.” He described the hack as “disgusting, greedy, rooted in my own insecurities, and wrong in every aspect.”

On a Tuesday morning last April, FBI agents arrived at Lane’s second‑floor dorm room around 6:30 a.m., announced a search warrant, and seized his devices along with luxury items bought with the proceeds. Lane recalled feeling “a wave of relief” and thanked the FBI, adding, “After they left, I was like, ‘It’s over… I’m done with this.’”

A federal judge in Massachusetts sentenced Lane to four years in federal prison and ordered him to pay more than $14 million in restitution.

Impact on PowerSchool

Following the breach, PowerSchool offered two years of credit‑monitoring and identity‑protection services to affected customers.

Other Recent Arrests

• A 15‑year‑old boy in Illinois allegedly attacked Las Vegas casinos, costing MGM Resorts more than $100 million.
• A British national, who at 16 helped breach over 110 companies worldwide, was linked to $115 million in extortion.

Origins on Roblox

Lane says the criminal activity began on Roblox, where he encountered cheaters, password‑stealers, and other cybercriminals sharing photos of their earnings. He noted that online forums can attract groups seeking to recruit potential hackers:

“The bad guys are on all the platforms watching the kids playing. When they see an elite‑level performer, they approach that kid, masquerading as another kid, and say, ‘Hey, you want to earn some money? Here are the tools, here are the techniques.’”

Personal Reflections

Lane spent his “ill‑gotten gains” on designer clothes, diamond jewelry, DoorDash deliveries, Airbnb rentals, and drugs—including high‑potency marijuana and acid. He said drugs helped numb his guilt, but hacking provided the strongest “high,” describing the adrenaline rush as “indescribable” and “way more than driving 120 mph.”

Roblox’s Response

On Monday, Roblox announced that, starting in June, it will offer age‑checked accounts for younger users. These accounts will limit the games they can play and more closely align content access, communication settings, and parental controls with the user’s age.