U.S. man sentenced to prison over data breach that included Canadian students’ info

Hands type on a computer keyboard. (THE CANADIAN PRESS/Graeme Roy)

An American man was sentenced Tuesday to four years in prison after pleading guilty to cyber extortion in the mass data breach of a student information system used across Canada.

Court documents show Matthew D. Lane was sentenced in a Massachusetts court after he pleaded guilty to charges relating to the cyber extortion of two companies.

The companies were not named in court documents but PowerSchool, a software and cloud storage company for school systems in the U.S. and Canada, confirmed Wednesday that Lane was the person behind its data breach.

“PowerSchool appreciates the efforts of the prosecutors and law enforcement who brought this individual to justice,” a company spokesperson said in an emailed statement.

“We remain focused on supporting our school partners and safeguarding student, family, and educator data.”

The U.S. Attorney’s Office previously said in a media release that Lane was a student at Assumption University in Worcester, Mass.

PowerSchool had told school boards in Newfoundland and Labrador, Nova Scotia, Ontario, Alberta and elsewhere across North America that it experienced a data breach between Dec. 22 and 28 of last year.

The Toronto District School Board, the largest school board in Canada, said in a letter to parents and caregivers in May that it had recently learned data stolen in December 2024 was not destroyed and that a “threat actor” had demanded ransom.

Court documents say a company targeted by Lane had received a ransom demand for $2.85 million worth of bitcoin with a threat to leak the names, email addresses, phone numbers, medical information and other data of millions of students and teachers.

PowerSchool said in May it had paid a ransom in hopes of preventing the public release of the stolen data, but it did not specify the amount.

In February, Canada’s federal privacy watchdog launched an investigation into the data breach. Privacy commissioner Philippe Dufresne discontinued the investigation in July, citing his office’s satisfaction with the company’s response and commitment to added security measures such as strengthened monitoring and detection tools.

PowerSchool has said it will provide the commissioner with an independent security assessment and report of its information safeguards by March 2026.

Rianna Lim, The Canadian Press