Get stories like this delivered straight to your inbox. Sign up for The 74 Newsletter

Worcester, Massachusetts

Computer hacker and former college student Matthew Lane — who was a teenager when he carried out a massive cyberattack on education technology company PowerSchool — was sentenced in federal court on Tuesday to four years in prison and ordered to pay more than $14 million in restitution.

Lane, a former Assumption University freshman who federal prosecutors described as a sophisticated and experienced cybercriminal, told a federal judge that his crimes occurred during an “extremely dark time in my life,” but acknowledged, “I deserve to be punished.” In June, Lane pleaded guilty to what is widely considered the largest exposure of private student data in history, a breach that compromised the sensitive information of some 60 million students and 10 million educators.

“I robbed actual people and their families of their sense of security,” Lane, now 20, told U.S. District Court Judge Margaret Guzman, his shaggy hair obscuring his eyebrows and the tops of his glasses, adding he was “thankful I got caught.”

Lane said he takes “full responsibility” for his crimes but that he was “disconnected from reality” while he engaged in hacking. He has since become “sober not just from drugs, but from the internet as well,” he told Guzman.

Accompanied in court by family members and several friends, Lane broke down and sobbed after learning his sentence, which includes three years ofsupervised release and a $25,000 fine.

He was convicted of cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers and aggravated identity theft. Federal prosecutors were seeking a seven-year prison term, describing Lane in a sentencing memo as being motivated by greed and said the threat to Powerschool warned, “we fully intend to destroy your company and bankrupt it to the point of no absolute return ” if it didn’t meet a $2.85 million ransom demand in Bitcoin.

Lane’s sentencing concludes a yearlong cybercrime saga, which began in September 2024 when prosecutors say he hacked into PowerSchool’s computer network and transferred stolen records to a leased server in Ukraine. About three months later, PowerSchool officials received the extortion demand to prevent sensitive student and teacher data — including the Social Security numbers of children as young as 5 — from being leaked “worldwide.”

Lane also pleaded guilty to working with an unnamed co-conspirator from Illinois to extort $200,000 from an unnamed U.S.-based wireless telecommunications company between April and May 2024 before he discussed the “need to hack another shitty company that(’)ll pay” and set his sights on PowerSchool.

Guzman, who appeared sympathetic to Lane’s young age at the time he carried out multiple cyberattacks, said the case should serve as a cautionary tale to parents everywhere and expressed alarm about the “breadth and reach of technology” to commit crimes anonymously. Guzman said the challenges Lane faced as a teenager, including social isolation and struggles to fit in with his peers, made him “vulnerable to falling through the rabbit hole.”

Guzman said society can’t go back to the days of typewriters and television sets with just five channels. But parents have placed computers in their children’s bedrooms and provided cell phones to grade schoolers without proper guardrails. Lane, she said, won’t be the last one to exhibit “bravado behind the screen of a computer.”

Defense attorney Sean Smith asked the judge to sentence Lane to three years in prison and three years of supervised release. Smith said Lane was “very much cognizant of the seriousness” of his offenses and that he pleaded guilty and “admitted fault almost from the get-go.”

Smith said Lane was a teenager when the cyberattacks unfolded and had no previous convictions. Letters of support submitted by family members to the court made clear Lane was “a generous, loving, patient individual,” who grappled with loneliness, depression and anxiety.

The seriousness of Lane’s actions “can’t be overstated,” said Assistant U.S. Attorney Kristen Kearney, who called his behavior “calculated.” The PowerSchool data breach has caused real harm to millions of people, she said, who now face stifled job prospects, heightened insurance costs and other harms that will follow them “for the rest of their lives.”

Kearney noted that Lane made several efforts to conceal his identity and avoid detection and was financially motivated: He desired designer clothes and jewelry, she said, and to “host parties at extravagant Airbnbs.”

Lane “did not make a teenage mistake” or get “mixed up with the wrong crowd,” she argued, but carried out “carefully planned attacks” for financial gain. Personal statements that put Lane in a positive light, she said, showed he was living “a double life.” In the online world, she said, digital chat messages included racial slurs, antisemitism and threats of sexual violence.

The prosecutor challenged Lane’s request for a three-year prison sentence, arguing that other cybercriminals could see it as the cost of doing business if they have millions of dollars in cryptocurrency waiting for them after their release. Lane returned about $160,000 to the government, according to a sentencing memo released last week, but roughly $3 million remains unaccounted for.

Kearney also disputed Smith’s assertion that Lane was a first-time offender at the time of the PowerSchool breach, despite his absence of a criminal record. Last week, federal officials accused him of carrying out at least eight cyberattacks dating back to at least 2021 when he was still in high school.

Prosecutors said the PowerSchool attack resulted in more than $14 million in damages, including the ransom payment and identity theft services for the students and teachers who were victimized.

In a statement to The 74 on Tuesday, PowerSchool said it “appreciates the efforts of the prosecutors and law enforcement who brought this individual to justice” and that the company remains focused on “supporting our school partners and safeguarding student, family and educator data.”

After the sentencing hearing, a tearful Lane, who wasn’t immediately taken into custody, was embraced by friends and family members.

“I’m sorry, guys,” he said to four friends outside the courtroom, exchanging hugs and handshakes before getting into an elevator. “I love you guys.”

Get stories like these delivered straight to your inbox. Sign up for The 74 Newsletter