By Mari Hansen On a Tuesday morning, when the light is still hazy, the text message arrived early. Somewhere on a highway between Massachusetts and Connecticut, Matthew Lane was riding in the back seat of his parents‘ vehicle on his way to the federal prison where he would spend the next four years. He wrote to ABC News, “It’s really depressing, and I’m just afraid.” He’s barely twenty.
He was a freshman at Assumption College a year ago, the type of young person who most likely blended in with a lecture hall. He was assisting in the nighttime operation of what federal officials are now referring to as the biggest cyberattack in the history of American education in his dorm room. The PowerSchool hack. 60 million kids. Ten million educators. While a teenager waited for the Bitcoin ransom to be paid, social security numbers, birth dates, medical records, and family information were all hanging on a hook.
| Bio Data | Details |
|---|---|
| Full Name | Matthew D. Lane |
| Age | 20 |
| Hometown | Sterling, Massachusetts |
| Former School | Assumption College, Worcester, Mass. |
| Charges | Cyber extortion, aggravated identity theft |
| Plea | Guilty (June 2024) |
| Sentence | 4 years in federal prison |
| Primary Target | PowerSchool |
| Victims at Risk | 60 million students, 10 million teachers |
| Ransom Demanded | $2.85 million in Bitcoin |
| Prison Location | Federal facility, Connecticut |
| Status | Serving sentence |
To be honest, it’s difficult to imagine. The dorm room. A laptop’s hum. A student in flip-flops is passing by while someone is surreptitiously extorting a business that provides services to 80% of North American school districts behind closed doors. Perhaps the most disturbing aspect of it is how it happened, which is almost banal.
The beginning of Lane’s story wasn’t malicious. Roblox is where it all began, of all places. He told ABC News that, like many lonely children, he found “solace” there as a child. The cheating then started. Then there were the hacking forums, where people referred to each other as geniuses and shared pictures of expensive cars and piles of cash. “That’s how I fell into it,” he remarked. He started pursuing big businesses at the age of fifteen. He acknowledged that the rush of a successful hack was “incomparable to any drug.” It’s worth pondering that statement.
The actual PowerSchool hack was practically clinical. According to court records, in the fall of 2024, Lane entered covertly using credentials that had been stolen from a contractor and waited. In late December, the threats were made. PowerSchool was compensated. In January 2025, the breach was made public. The FBI then arrived at his dorm. He claims to have felt relieved. “After they left, I was like, ‘It’s over … I’m done with this.'”
Two days before reporting to prison, he now speaks with an odd humility. He says he must leave, calling his behavior “disgusting,” “greedy,” and “rooted in my own insecurities.” He even expresses gratitude to the FBI, which is not something you hear from someone in handcuffs very often. It’s difficult to determine whether to interpret this as sincere regret or as the deft framing of someone who has already met his attorneys.
In a statement, Roblox stated that it closely collaborates with law enforcement and has zero tolerance for cybercrime. the type of statement that businesses must write. Meanwhile, PowerSchool continues to provide awkward answers regarding why a contractor’s credentials were sufficient to gain access to tens of millions of children’s records. That section of the narrative has nothing to do with Matthew Lane.
He expresses the hope that his case will serve as a warning. Perhaps it will. Perhaps one child will stop scrolling through a hacking forum this evening. Perhaps not. Observing all of this gives me the impression that the true lesson isn’t about one boy from Sterling, Massachusetts, but rather about how easily a Roblox account can serve as the starting point for a four-year sentence and how thin the barrier is between an inquisitive teenager and a federal prison cell.