U.S. man sentenced to prison over data breach that included Canadian students’ info

By: Rianna Lim, The Canadian Press Posted: 3:13 PM CDT Wednesday, Oct. 15, 2025 Last Modified: 4:07 PM CDT Wednesday, Oct. 15, 2025

Advertise with us

An American man was sentenced Tuesday to four years in prison after pleading guilty to cyber extortion in the mass data breach of a student information system used across Canada.

Read this article for free:

or

Already have an account? Log in here »

To continue reading, please subscribe:

*First annual payment billed as $205.00 + GST for one year. This annual subscription will automatically renew at $233.00 + GST every 52 weeks (10% off the regular annual price of $259.35). Offer available to new and qualified returning subscribers only. Cancel any time.

An American man was sentenced Tuesday to four years in prison after pleading guilty to cyber extortion in the mass data breach of a student information system used across Canada.

Read unlimited articles for free today:

or

Already have an account? Log in here »

Hey there, time traveller!
This article was published 15/10/2025 (315 days ago), so information in it may no longer be current.

An American man was sentenced Tuesday to four years in prison after pleading guilty to cyber extortion in the mass data breach of a student information system used across Canada.

Court documents show Matthew D. Lane was sentenced in a Massachusetts court after he pleaded guilty to charges relating to the cyber extortion of two companies.

The companies were not named in court documents but PowerSchool, a software and cloud storage company for school systems in the U.S. and Canada, confirmed Wednesday that Lane was the person behind its data breach.

Hands type on a computer keyboard in Toronto in this Sunday, Oct. 9 photo illustration. THE CANADIAN PRESS/Graeme Roy

“PowerSchool appreciates the efforts of the prosecutors and law enforcement who brought this individual to justice,” a company spokesperson said in an emailed statement.

“We remain focused on supporting our school partners and safeguarding student, family, and educator data.”

The U.S. Attorney’s Office previously said in a media release that Lane was a student at Assumption University in Worcester, Mass.

PowerSchool had told school boards in Newfoundland and Labrador, Nova Scotia, Ontario, Alberta and elsewhere across North America that it experienced a data breach between Dec. 22 and 28 of last year.

The Toronto District School Board, the largest school board in Canada, said in a letter to parents and caregivers in May that it had recently learned data stolen in December 2024 was not destroyed and that a “threat actor” had demanded ransom.

Court documents say a company targeted by Lane had received a ransom demand for $2.85 million worth of bitcoin with a threat to leak the names, email addresses, phone numbers, medical information and other data of millions of students and teachers.

PowerSchool said in May it had paid a ransom in hopes of preventing the public release of the stolen data, but it did not specify the amount.

In February, Canada’s federal privacy watchdog launched an investigation into the data breach. Privacy commissioner Philippe Dufresne discontinued the investigation in July, citing his office’s satisfaction with the company’s response and commitment to added security measures such as strengthened monitoring and detection tools.

PowerSchool has said it will provide the commissioner with an independent security assessment and report of its information safeguards by March 2026.

This report by The Canadian Press was first published Oct. 15, 2025.