Teen hacker says PowerSchool breach put millions of children at risk

Matthew Lane said he was a malicious hacker by age 15, and as his parents drove him to federal prison in Connecticut, he texted that he was “extremely sad” and “scared.” The 20-year-old’s account has become a warning about how young cybercrime can start, and how far its damage can travel when school data is exposed.

The PowerSchool breach reached deep into the records systems used by schools across North America. PowerSchool is used by 80% of school districts in North America, and the Justice Department said the attack put at risk the security of 60 million children and 10 million teachers. Lane said the stolen data could have exposed Social Security numbers, dates of birth, family information, grades and confidential medical information, a reminder that a breach in education technology can quickly become a threat to identity, privacy and family stability.

The breach was described as the biggest cyberattack in U.S. education history and serious enough to prompt briefings inside the White House Situation Room. PowerSchool’s December 28, 2024 incident involved student and teacher information, including names, addresses, birthdays and, in some cases, Social Security numbers and medical information. In May 2025, PowerSchool said it believed threat actors were using data from that breach to extort school districts and that it had reported the matter to law enforcement in the United States and Canada.

The case also shows how teenage offenders can now operate with tools once associated with organized adult criminals. FBI Supervisory Special Agent Doug Domin said investigators have worked cases involving suspects as young as 14. The pipeline is alarming: social media and gaming platforms can glorify criminal behavior, while hacking tools are easy to find, lowering the barrier for teenagers who might once have lacked the technical reach to do this kind of harm.

Lane’s own case moved through court with heavy consequences. He pleaded guilty to four charges tied to unauthorized computer access, identity theft and cyber extortion. NBC News reported that PowerSchool received an extortion demand of about $2.85 million in bitcoin and that Lane agreed not to challenge a prison sentence shorter than nine years and four months. ABC7 Chicago reported that he was sentenced in November 2025 to four years in federal prison and ordered to pay more than $14 million in restitution.

The damage did not end with the schools. A Chicago-area parent said she froze her children’s credit after receiving a breach notice, showing how a cyberattack on a student database can force families into years of defensive cleanup. For children whose birthdays, grades and medical details were pulled into the dark economy of extortion, the breach turned school records into a lasting vulnerability.