U.S. man sentenced to prison over data breach that included Canadian students’ info
Advertisement
Read this article for free:
or
Already have an account? Log in here »
We need your support!
Local journalism needs your support!
As we navigate through unprecedented times, our journalists are working harder than ever to bring you the latest local updates to keep you safe and informed.
Now, more than ever, we need your support.
Starting at $15.99 plus taxes every four weeks you can access your Brandon Sun online and full access to all content as it appears on our website.
Subscribe Nowor call circulation directly at (204) 727-0527.
Your pledge helps to ensure we provide the news that matters most to your community!
To continue reading, please subscribe:
Add Brandon Sun access to your Free Press subscription for only an additional
$1 for the first 4 weeks*
*Your next subscription payment will increase by $1.00 and you will be charged $20.00 plus GST for four weeks. After four weeks, your payment will increase to $24.00 plus GST every four weeks.
Read unlimited articles for free today:
or
Already have an account? Log in here »
An American man was sentenced Tuesday to four years in prison after pleading guilty to cyber extortion in the mass data breach of a student information system used across Canada.
Court documents show Matthew D. Lane was sentenced in a Massachusetts court after he pleaded guilty to charges relating to the cyber extortion of two companies.
The companies were not named in court documents but PowerSchool, a software and cloud storage company for school systems in the U.S. and Canada, confirmed Wednesday that Lane was the person behind its data breach.
“PowerSchool appreciates the efforts of the prosecutors and law enforcement who brought this individual to justice,” a company spokesperson said in an emailed statement.
“We remain focused on supporting our school partners and safeguarding student, family, and educator data.”
The U.S. Attorney’s Office previously said in a media release that Lane was a student at Assumption University in Worcester, Mass.
PowerSchool had told school boards in Newfoundland and Labrador, Nova Scotia, Ontario, Alberta and elsewhere across North America that it experienced a data breach between Dec. 22 and 28 of last year.
The Toronto District School Board, the largest school board in Canada, said in a letter to parents and caregivers in May that it had recently learned data stolen in December 2024 was not destroyed and that a “threat actor” had demanded ransom.
Court documents say a company targeted by Lane had received a ransom demand for $2.85 million worth of bitcoin with a threat to leak the names, email addresses, phone numbers, medical information and other data of millions of students and teachers.
PowerSchool said in May it had paid a ransom in hopes of preventing the public release of the stolen data, but it did not specify the amount.
In February, Canada’s federal privacy watchdog launched an investigation into the data breach. Privacy commissioner Philippe Dufresne discontinued the investigation in July, citing his office’s satisfaction with the company’s response and commitment to added security measures such as strengthened monitoring and detection tools.
PowerSchool has said it will provide the commissioner with an independent security assessment and report of its information safeguards by March 2026.
This report by The Canadian Press was first published Oct. 15, 2025.