U.S. man sentenced to prison over data breach that included Canadian students’ info
Advertisement
Read this article for free:
or
Already have an account? Log in here »
To continue reading, please subscribe:
Digital Subscription
One year of digital access for only $205*
- Enjoy unlimited reading on winnipegfreepress.com
- Read the E-Edition, our digital replica newspaper
- Access News Break, our award-winning app
- Play interactive puzzles
*First annual payment billed as $205.00 + GST for one year. This annual subscription will automatically renew at $233.00 + GST every 52 weeks (10% off the regular annual price of $259.35). Offer available to new and qualified returning subscribers only. Cancel any time.
To continue reading, please subscribe:
Add Free Press access to your Brandon Sun subscription for only an additional
$1 for the first 4 weeks*
- Enjoy unlimited reading on winnipegfreepress.com
- Read the E-Edition, our digital replica newspaper
- Access News Break, our award-winning app
- Play interactive puzzles
*Your next Brandon Sun subscription payment will increase by $1.00 and you will be charged $17.95 plus GST for four weeks. After four weeks, your payment will increase to $24.95 plus GST every four weeks.
Read unlimited articles for free today:
or
Already have an account? Log in here »
Hey there, time traveller!
This article was published 15/10/2025 (310 days ago), so information in it may no longer be current.
An American man was sentenced Tuesday to four years in prison after pleading guilty to cyber extortion in the mass data breach of a student information system used across Canada.
Court documents show Matthew D. Lane was sentenced in a Massachusetts court after he pleaded guilty to charges relating to the cyber extortion of two companies.
The companies were not named in court documents but PowerSchool, a software and cloud storage company for school systems in the U.S. and Canada, confirmed Wednesday that Lane was the person behind its data breach.
“PowerSchool appreciates the efforts of the prosecutors and law enforcement who brought this individual to justice,” a company spokesperson said in an emailed statement.
“We remain focused on supporting our school partners and safeguarding student, family, and educator data.”
The U.S. Attorney’s Office previously said in a media release that Lane was a student at Assumption University in Worcester, Mass.
PowerSchool had told school boards in Newfoundland and Labrador, Nova Scotia, Ontario, Alberta and elsewhere across North America that it experienced a data breach between Dec. 22 and 28 of last year.
The Toronto District School Board, the largest school board in Canada, said in a letter to parents and caregivers in May that it had recently learned data stolen in December 2024 was not destroyed and that a “threat actor” had demanded ransom.
Court documents say a company targeted by Lane had received a ransom demand for $2.85 million worth of bitcoin with a threat to leak the names, email addresses, phone numbers, medical information and other data of millions of students and teachers.
PowerSchool said in May it had paid a ransom in hopes of preventing the public release of the stolen data, but it did not specify the amount.
In February, Canada’s federal privacy watchdog launched an investigation into the data breach. Privacy commissioner Philippe Dufresne discontinued the investigation in July, citing his office’s satisfaction with the company’s response and commitment to added security measures such as strengthened monitoring and detection tools.
PowerSchool has said it will provide the commissioner with an independent security assessment and report of its information safeguards by March 2026.
This report by The Canadian Press was first published Oct. 15, 2025.
Related Articles
Federal privacy watchdog discontinues investigation into student data breach
Advertisement Advertise With Us
