PowerSchool hacker gets sentenced to four years in prison

In December 2024, 19-year-old Matthew D. Lane and accomplices used credentials stolen from a subcontractor to breach PowerSchool's PowerSource support portal and a maintenance tool, exfiltrating databases from 6,505 school districts that contained personal information for approximately 9.5 million teachers and 62.4 million students; they demanded $2.85 million in Bitcoin and attempted additional district-level extortion. Lane pleaded guilty, was sentenced to four years in prison and ordered to pay $14 million restitution and a $25,000 fine; PowerSchool paid a ransom, faces lawsuits including from the Texas Attorney General, and investigations noted prior related breaches in Aug–Sept 2024 though attribution across incidents was unclear.