A U.S. man has been sentenced to four years in prison for his role in a major cyber extortion scheme that exposed sensitive information from Canadian students through a widely used education software system.
Court documents from Massachusetts show that Matthew D. Lane pleaded guilty to charges related to the cyber extortion of two companies, including PowerSchool — a software and cloud storage provider for schools across the U.S. and Canada. The breach took place between December 22 and 28 of last year and affected school boards in Newfoundland and Labrador, Nova Scotia, Ontario, Alberta, and beyond.
PowerSchool confirmed that Lane was responsible for the attack, which involved stealing large amounts of student information and threatening to make it public unless a ransom was paid. In May, the company admitted to paying the ransom in hopes of preventing the release of the stolen data.
Canada’s federal privacy commissioner later closed its investigation into the incident, stating that PowerSchool’s response and strengthened security measures were satisfactory.
The sentencing underscores the growing threat of cyberattacks on educational institutions and the real-world consequences for those who exploit sensitive student information for profit.