A Massachusetts teenager has pled guilty to a number of hacking crimes, including his role in the penetration of a cloud company with data on tens of millions of children, the government says.
On Wednesday, the Justice Department said that 19-year-old Matthew D. Lane of Sterling, Massachusetts, had entered into a plea agreement for his role in a number of high-profile hacking episodes. The former college student pled guilty to charges related to cyber extortion, as well as aggravated identity theft, and other crimes.
Lane is accused of personally hacking a company using stolen employee login credentials. While this company hasn’t been named in court documents, NBC has reported that the victim is PowerSchool, a cloud and analytics provider that says it services K-12 schools across North America. NBC describes it as “one of the top tech education companies” in the country. Lane’s compromise of it last year led to the theft of data on tens of millions of children. The information that Lane stole included the “Social Security numbers, dates of birth, and confidential medical information, among other data, of the students and faculty” sourced from the company’s network.
Not long after Lane stole the data, the company received an extortion message. That message threatened to “leak . . . worldwide” the “names, email addresses, phone numbers, Social Security numbers, dates of birth, medical information, residential addresses, parent and guardian information, and passwords, among other data, of more than 60 million students and 10 million teachers if Victim 2 did not send 30 Bitcoin (approximately $2.85 million at the time) to a specific Bitcoin address,” federal prosecutors write. Gizmodo reached out to PowerSchool for comment.
According to the Justice Department, Lane was also part of a criminal group that stole data from a telecommunications firm and then sought to extort the company for $200,000. It is unknown who actually hacked the telecom, though Lane is said to have used an anonymous email to contact the telecom directly, telling it to fork over the ransom in Bitcoin or suffer a humiliating data breach. Lane purportedly said: “We are the only ones with a copy of this data now. Stop this nonsense [or] your executives and employees will see the same fate . . . . Make the correct decision and pay the ransom. If you keep stalling, it will be leaked.”
“Matthew Lane apparently thought he found a way to get rich quick, but this 19-year-old now stands accused of hiding behind his keyboard to gain unauthorized access to an education software provider to obtain sensitive data which was used in an attempt to extort millions of dollars,” said FBI official Kimberly Milka.
