An American man was sentenced Tuesday to four years in prison after pleading guilty to cyber extortion in the massive data breach of a student information system used across Canada.
Court documents show Matthew D. Lane was sentenced in a Massachusetts court after pleading guilty to charges related to cyber extortion against two companies.
The companies were not named in court documents, but PowerSchoolThe company, which develops software and cloud storage for school systems in the United States and Canada, confirmed Wednesday that Lane was behind the data breach.
“PowerSchool appreciates the efforts of prosecutors and law enforcement in bringing this individual to justice,” a company spokesperson said in an emailed statement.
“We remain focused on supporting our school partners and protecting the data of students, families and educators.”
The U.S. Attorney's Office previously said in a news release that Lane was a student at Assumption University in Worcester, Massachusetts.
PowerSchool informed school boards in Newfoundland and Labrador, Nova Scotia, Ontario, Alberta and other regions of North America that a data breach occurred between December 22 and 28 last year.
The Toronto District School Board, Canada's largest school board, said in a letter to parents and guardians in May that it had recently learned that the data stolen in December 2024 had not been destroyed and that an “attacker” had demanded a ransom.
Get the latest national news
To stay on top of news affecting Canada and the world, sign up for breaking news alerts delivered directly to you as they happen.
Court documents say the company Lane targeted received a $2.85 million ransom demand in Bitcoin, threatening to release the names, email addresses, phone numbers, medical information and other data of millions of students and faculty.
In May, PowerSchool said it paid the ransom in hopes of preventing the stolen data from being publicly released, but did not specify the amount.
Canada's federal privacy watchdog launched an investigation into the data breach in February.
Privacy Commissioner Philippe Dufresne ended the investigation in July, citing his office's satisfaction with the company's response and willingness to take additional security measures, such as enhanced monitoring and detection tools.
PowerSchool said it will provide the commissioner with an independent security assessment and report on its information security by March 2026.
© 2025 The Canadian Press
