Forgot your password?
Close
typodupeerror
Crime

20-Year-Old Enters Prison for Historic Breach, Ransoming of Massive Student Database (abcnews.com) 50

Posted by EditorDavid from the buy-and-cell dept.
20-year-old Matthew Lane sent a text message to ABC News as his parents drove him to federal prison in Connecticut. "I'm just scared," he said, calling the whole situation "extremely sad." Barely a year earlier, while still a teenager, he helped launch what's been described as the biggest cyberattack in U.S. education history — a data breach that concerned authorities so much, it prompted briefings with senior government officials inside the White House Situation Room. The breach pierced the education technology company PowerSchool — used by 80% of school districts in North America... [and operating in about 90 countries around the world]. With threats to expose social security numbers, dates of birth, family information, grades, and even confidential medical information, the breach cornered PowerSchool into paying millions of dollars in ransom.

"I think I need to go to prison for what I did," Lane told ABC News in an exclusive interview, speaking publicly for the first time about the headline-grabbing heist and his life as a cybercriminal. "It was disgusting, it was greedy, it was rooted in my own insecurities, it was wrong in every aspect," he said in the interview, two days before reporting to prison... At about 6:30 on a Tuesday morning last April, FBI agents started banging on the door of Lane's second-floor dorm room. "FBI! We have a search warrant," Lane recalled them shouting. They seized his devices and many of the luxury items he bought with "dirty" money, as he put it. He said he felt a "wave of relief.... I'm honestly thankful for the FBI," he said. "After they left, I was like, 'It's over ... I'm done with this'..."

A federal judge in Massachusetts sentenced him to four years in federal prison and ordered him to pay more than $14 million in restitution.
"In the wake of the breach, PowerSchool offered two years' worth of credit-monitoring and identity protection services to concerned customer," the article points out. But it also notes two other arrests in September of teenaged cybercriminals:

- A 15-year-old boy in Illinois who allegedly attacked Las Vegas casinos, reportedly costing MGM Resorts alone more than $100 million

- A British national who when he was 16 helped breach over 110 companies around the world and extort $115 million.


But ironically, Lane tells ABC News it all started on Roblox, where he'd met cheaters, password-stealers, and cybercriminals sharing photos of their stacks of money, creating a "sense of camaraderie" Lane and others warn that online forums also attract criminal groups seeking to recruit potential hackers. "The bad guys are on all the platforms watching the kids playing," Hay said. "And when they see an elite-level performer, they go approach that kid, masquerading as another kid, and they go, 'Hey, you want to earn some [money]? ... Here are the tools, here are the techniques'...."

According to Lane, he spent his "ill-gotten gains" on designer clothes, diamond jewelry, DoorDash deliveries, Airbnb rentals for him and his friends, and drugs — "lots of drugs." He said he would numb ever-present feelings of guilt with drugs — from high-potency marijuana to acid. But it was hacking that gave him the strongest high. "It's indescribable the adrenaline you get when you do something like that," he said. "It's way more than driving 120 miles per hour. ... Incomparable to any drug at all, as well."
"On Monday, Roblox announced that, starting in June, it will offer age-checked accounts for younger users that limit what games they can play, and add 'more closely align content access, communication settings, and parental controls with a user's age.'"

20-Year-Old Enters Prison for Historic Breach, Ransoming of Massive Student Database More | Reply

20-Year-Old Enters Prison for Historic Breach, Ransoming of Massive Student Database

Comments Filter:

  • You commited a crime (Score:4, Informative)

    by Valgrus Thunderaxe ( 8769977 ) on Saturday April 18, 2026 @01:05PM (#66100200)
    There are consequences. Welcome to adulthood.

  • Moral of the story: (Score:5, Insightful)

    by Gravis Zero ( 934156 ) on Saturday April 18, 2026 @01:06PM (#66100202)

    If a massive amount of critical information and system of your business can be held hostage by a child then you are not "taking security very seriously" and you do not "respect the rights of [your] users".

    That fact that stuff like this happens is astoundingly stupid. This foolish child isn't innocent but the businesses are all guilty as a hell.

    • Maybe not guilty as hell but definitely negligent.

      • Re: (Score:2)

        by smithmc ( 451373 )
        When you have that kind of information in your possession and you are negligent with it, you are guilty as hell.

    • Re: (Score:2)

      by malkavian ( 9512 )

      It's not just a child. It's a child plus a network of organised crime that specialises in tooling for illicit compromise, which said child has access to, plus contacts with compromise experience to learn from. This changes things significantly.

      Cybersecurity is a hellishly expensive thing if done to the degree that's found in financials and the like (where a bad compromise could have serious international ramifications).
      Most places don't have the budget to hire enough of the right staff to protect against

    • I've heard similar arguments in jail. Psychopaths blame the victims for allowing themselves to be exploited.

      Calling him a 'child' is a bit of a stretch, too, unless you mean 'an immature or irresponsible person' or 'a person who has little or no experience in a particular area' or 'a young human below the age of puberty'. It implies that he shouldn't be treated as an adult....and the court decided he should be.

      • I've heard similar arguments in jail. Psychopaths blame the victims for allowing themselves to be exploited.

        You see this as victim and perpetrator. I see this as, lesser perpetrator and greater perpetrator. Both parties are to blame. The world is not black and white, it is a sea of gray.

        Calling him a 'child' is a bit of a stretch, too, unless you mean 'an immature or irresponsible person' or 'a person who has little or no experience in a particular area' or 'a young human below the age of puberty'.

        "Lane said he was a prolific cyber criminal by age 15, and usually directed his cyberattacks toward "big, big" targets."

        It implies that he shouldn't be treated as an adult....and the court decided he should be.

        No, that's what you have inferred. He's an adult now and will be treated as such.

    • Security weakness is not consent to intrusion.

    • Give lip service to security and walk away from any breaches with the words, "nothing could be done". That is the business model for everything that people do not want to take seriously.

      The results speak for themselves, but nobody is listening to the results, just to the lip service.

  • corporation.

    1. Why do we not have a way to catch these bad actors early and redirect their talent to something more beneficial? Of course the human nature part of the pursuit of riches gets in the way here.

    2. Let me start by saying that this guy deserves to go to prison for what he did. However, a lot of laws are bought and paid for by corporations bent on severely punishing people for things which put a dent in profitability. I would argue it is similar to "contempt of cop" but for the benefit of "virtual

    • 1. Why do we not have a way to catch these bad actors early and redirect their talent to something more beneficial?

      Because often these folks aren't actually talented and are just being opportunistic criminals. Lots of things aren't secured particularly well in real life too, but we don't offer well paying jobs to every kid who learns lock picking from YouTube, either.

      Admittedly, because these companies being breached have their systems connected to the global internet, they should be taking security a bit more seriously since the culprit may not always be an American or from a country with an extradition treaty. But a

      • Re: (Score:2)

        by hwstar ( 35834 )

        So maybe the conviction and sentencing, and punishment meted out should consist of 2 parts. One for the perpetrator, and the other for the corporation who let their guard down. The problem is, you can never be sure all of the vulnerabilities are mitigated on your attack surface. Also how do you convict a corporation without designating some corporate officer with is the equivalent of a whipping boy, and who gets to go to jail on behalf of the corporation.

  • Before you go into any prison, you have to pick up the red, blue, and gold card(s). And a berserker pack.

  • He's just another script kiddie that was gassed up by the real threat actors, then handed tools. 9 out of 10 times one of these kids go down, they aren't the brains behind the incident.
    They even admitted that somebody else provided the tools. Its just sad that they still belive that they were selected for their leet skillz.

  • A single company has 80% of all data concerning education and students.

    That seems like a much bigger deal here.

    You can send all the 20-year-olds you want to jail for as long as you want and it will never make that okay. But hey security theater is a thing and old people like seeing young people get harmed. I don't know why we just seem to like it a whole hell of a lot.
    • The affected parties are guilty of stupidity. The punk kid sounds  more like a messenger   than a criminal. But, of-course he did commit crimes; did any of his victims 'get the message'? I doubt it.
    • And unlike the state, city or in this case school district this company that controls eighty or so percent of the market is a company you do not elect or have much of any say in.

  • Why is his age news? (Score:3)

    by couchslug ( 175151 ) on Saturday April 18, 2026 @04:06PM (#66100438)

    He's an adult criminal, not a child. He chose his fate.

    • If only we held the same strict standard to the people casually ransacking retail stores in urban areas.

  • It's all fun and games until that happens

    "Mathew Boderick" almost touched off a global thermonuclear war... And walked away.
    "Mr Robot" was fighting the good fight... As if THAT really happens.

    The fact is, investigating your own gear is a-ok. stuff that belongs to others... It get's dark gray really fast. Make bucks at it... It's not gray at all. Pitch black.

  • The real take away here ... (Score:1)

    by Anonymous Coward

    Information security is still being treated as a joke, an afterthought by corporations that process PII in bulk.

    Yes, it is fine to "slap 'em in irons" for breaching these systems, but why aren't there serious penalties for the owners and operators of these systems who fail to protect them with better security than the equivalent of rent-a-cops?

  • The biggest actors in the hacking world are governments. Countries like: Russia, North Korea, Iran, but also the USA and Israel. Probably others as well.

    So the fact that some kid was able to access so much info is quite worrisome. If he had worked for the NSA they would have paid him nicely to hack, but since he did it on his own (or unknowingly for another government) he's going to jail.

    The biggest threat to cybersecurity these days are governments!

  • While I'm clearly opposed to the U.S. prison system I would call a violation of basic human rights, the prison term is most likely based on his extortion attempt to ransom 2.4 Million USD

    along with him being not an influential millionaire, and go to a minimum security prison similar to the one Jeffrey E. went for.

    And from my POV this should be the only crime he should "rethink" what he would be in for.

    https://www.justice.gov/usao-m... [justice.gov]

    But I'm also in favor that the people responsible for the security holes t

    • Re: (Score:2)

      by kackle ( 910159 )

      the prison term is most likely based on his ... being not an influential millionaire

      Not for a lack of trying!

  • The problem is more than, a teenager was groomed to commit crimes.

    - So much PII information in one database,
    - Much of the sensitive data (Eg. medical) was not encrypted at rest,
    - Was this database HIPPA compliant?
    - An apparent failure to identify the breach and block the connection,
    - an apparent failure to hold the corporation accountable for these failures.

    Next time the criminal won't grab money, he'll save all that Id. information for 10 years, then commit wide-scale, unstoppable identity thef

  • Lots of people who have tremendous skills, but behind that brain there's no understanding of empathy and social justice. The only thing they know is themselves. That's why, while very talented in technical, they chose to do things that will certainly land them in jail. FAFO baby!!
  • Instead of sending these people to jail, we should be waking up and realizing that we don't take data security seriously. There is no reason for Power School to store that much information about people, and ignoring that volume of information, why wasn't it encrypted with multiple layers of protection, and kill switches? The same goes for countless companies, you can't just store information, you need to protect it, and protection means it's unusable to anyone but the intended party.

    It's not even enoug

Slashdot Top Deals

The time spent on any item of the agenda [of a finance committee] will be in inverse proportion to the sum involved. -- C.N. Parkinson

Close