A 19-year-old college student will plead guilty to carrying out a massive hack against PowerSchool, a popular student information system used by schools around the country. On Tuesday, the Department of Justice said Matthew Lane of Massachusetts agreed to plead guilty to four counts, including cyber extortion, unauthorized access to protected computers, and aggravated identity theft.
Though the DOJ doesn’t identify PowerSchool by name, the details outlined by the DOJ line up with the attack, such as the hacker’s threat to leak the names, email addresses, phone numbers, Social Security numbers, dates of birth, and medical information of tens of millions of students and teachers if the company didn’t pay a $2.85 million ransom. A source close to the situation also tells NBC News that the company in question is PowerSchool.
In January, PowerSchool said it became aware of a data breach involving the “unauthorized exfiltration of certain personal information” from its customer support portal, PowerSource. The company later revealed that it paid the ransom in an attempt to keep the attacker from making its information public.
However, PowerSchool customers later received additional threats to expose stolen data. “As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us,” PowerSchool said.
The DOJ accuses Lane of breaking into PowerSchool using stolen login credentials and transferring the information of students and teachers to a computer server in Ukraine.
The agency also charged Lane with breaching and extorting another unnamed US-based telecom company.
“As alleged, this defendant stole private information about millions of children and teachers, imposed substantial financial costs on his victims, and instilled fear in parents that their kids’ information had been leaked into the hands of criminals — all to put a notch in his hacking belt,” US Attorney Leah Foley said in the press release.
