News Summary

Matthew Lane, a 19-year-old student at Assumption University, has agreed to plead guilty to multiple cyber extortion charges after compromising sensitive data from a telecommunications company, demanding large ransoms in Bitcoin. His illegal activities led to the exposure of personal data for millions, raising serious concerns about data security, especially in educational institutions. U.S. Attorney Leah Foley condemned his actions, emphasizing the urgency for improved cyber protection across various sectors.

Worcester, Massachusetts—Matthew Lane, a 19-year-old student at Assumption University, has agreed to plead guilty to a series of cyber extortion charges stemming from a significant data breach that affected millions of individuals. The charges against him include cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers, and aggravated identity theft.

The U.S. Attorney’s Office, led by U.S. Attorney Leah Foley, is prosecuting the case after Lane allegedly compromised sensitive customer data from a telecommunications company by utilizing stolen login credentials. In the spring of 2024, Lane demanded a ransom of $200,000 in Bitcoin from the telecommunications company through an anonymous email, threatening to leak the stolen data if the ransom was not paid.

After the company chose not to comply with his initial demand, Lane reduced the ransom to $75,000. Additionally, he discussed plans with a co-conspirator to target another company that might agree to pay a ransom. Lane’s criminal activities escalated when he targeted a software and cloud storage company, which services schools. He gained unauthorized access using an employee’s credentials, allowing him to steal sensitive personal data of over 60 million students and 10 million teachers, including Social Security numbers, medical information, and passwords. He transferred this data to a computer server he leased in Ukraine.

The software company, identified as PowerSchool, later confirmed that it paid a ransom estimated at 30 Bitcoin, roughly $2.85 million, to prevent the leakage of this critical information. This incident underscores the severe implications of cyber extortion on educational institutions and the data security challenges they face.

FBI Acting Special Agent Kimberly Milka emphasized the seriousness of Lane’s actions, particularly the far-reaching impact of the data breach on individuals and families nationwide. The case has raised concerns about the vulnerability of personal information, which is increasingly under threat from cybercriminal activities.

A plea hearing for Matthew Lane has not yet been scheduled, but each count of cyber extortion and unauthorized access to protected computers could see him facing a maximum sentence of five years behind bars, along with substantial fines. Moreover, the charge related to aggravated identity theft carries a mandatory minimum sentence of two years, which would be served consecutively to any time given for his other charges.

U.S. Attorney Leah Foley condemned Lane’s actions as deeply troubling, especially the fear his criminal conduct instilled in parents around the safety of their children’s private information. As cyber extortion remains a growing concern, this case highlights the urgent need for enhanced data security measures to protect sensitive information across various sectors, particularly in education and public services.

The increasing frequency of such incidents serves as a stark reminder of the vulnerabilities associated with digital data in today’s interconnected age. As law enforcement agencies continue to address the rising threat of cybercrime, the implications of Lane’s actions reflect broader challenges regarding data protection and integrity within our society.