On a current Tuesday morning, as his dad and mom had been driving him to the federal jail in Connecticut the place he’ll be locked up for the foreseeable future, 20-year-old Matthew Lane despatched a textual content message to ABC Information.
“It is extraordinarily unhappy, and I am simply scared,” he wrote.
Barely a 12 months earlier, whereas nonetheless a young person, he helped launch what’s been described as the most important cyberattack in U.S. schooling historical past — an information breach that involved authorities a lot, it prompted briefings with senior authorities officers contained in the White Home State of affairs Room.
The breach pierced the schooling expertise firm PowerSchool — utilized by 80% of faculty districts in North America — and “put in danger the safety of 60 million kids and 10 million academics,” the Justice Division mentioned.
With threats to show social safety numbers, dates of start, household data, grades, and even confidential medical data, the breach cornered PowerSchool into paying hundreds of thousands of {dollars} in ransom.
“I feel I have to go to jail for what I did,” Lane advised ABC Information in an unique interview, talking publicly for the primary time concerning the headline-grabbing heist and his life as a cybercriminal.
“It was disgusting, it was grasping, it was rooted in my very own insecurities, it was unsuitable in each facet,” he mentioned within the interview, two days earlier than reporting to jail.
Matthew Lane seems out a window in Worcester, Massachusetts, two days earlier than reporting to federal jail.
ABC Information
Lane is only one instance of what cybersecurity specialists, authorities and even Lane himself say is a wide-ranging menace: a brand new technology of tech-savvy youngsters who’re uniquely harmful and surprisingly younger.
“We have labored instances the place people as younger as 14 are being interviewed by the FBI,” mentioned Supervisory Particular Agent Doug Domin, who oversaw the PowerSchool investigation out of the FBI’s Boston discipline workplace.
Members of Era Z — who’ve had digital units and the Web of their lives since start — are significantly susceptible to the attract of cybercrime as a result of the social media platforms they inhabit can glorify “a felony life-style”; the gaming platforms they frequent can increase their “hacker ability units”; and the expertise used for hacking is “so accessible,” in response to Fergus Hay, the CEO of a European-based group referred to as “The Hacking Video games” that is now working to maintain children all over the world out of cybercrime.
“So a teen with much less technical abilities can do extra injury than a earlier technology,” Hay mentioned.
In September, authorities arrested a boy from Illinois who in 2023, at age 15, allegedly launched a devastating cyberattack on Las Vegas casinos that reportedly price MGM Resorts alone greater than $100 million. He’s awaiting trial.
The identical month, the Justice Division introduced the abroad arrest of a 19-year-old British nationwide who, beginning at age 16, allegedly helped a infamous worldwide cybergang hack into the networks of practically 50 U.S. firms and greater than 60 others all over the world, extorting them out of $115 million in complete. He has but to be extradited.
Fergus Hay, the CEO of The Hacking Video games, speaks to highschool college students in Manchester, England.
ABC Information
Hay and his group of entrepreneurs and cybersecurity specialists, which features a former FBI agent, say they’re so involved about what may very well be coming subsequent that they’ve launched an schooling and media marketing campaign focusing on Era Z, backed by a testing platform they developed to establish what they are saying is often-overlooked expertise for the cybersecurity discipline.
“You have received this complete younger technology who’re like free-range chickens on the market,” Hay mentioned. “Below no steerage, they will fall into actually, actually unhealthy habits. Below the suitable steerage, you possibly can take this technology and use their abilities [positively].”
For Lane, such intervention got here too late.
“I could not cease,” he mentioned of his cyber crimes. “I used to be hooked on hacking.”
‘That is how I fell into it’
In accordance with Lane, his story started on Roblox, the colossal on-line gaming platform standard with kids and teenagers.
As he remembers it, by the point he was 9 or 10 years outdated, he was struggling together with his psychological well being and what he later would be taught was autism. He mentioned he felt “completely different” and like “an outcast” in school, so he discovered “solace” on Roblox.
However on Roblox he additionally discovered cheaters — individuals who might reprogram video games to realize a bonus — and he wished to determine how to try this too, he mentioned.
That led him to a world of on-line “hacking boards,” the place achieved hackers not solely share commerce secrets and techniques but in addition promote huge databases of stolen data — together with hijacked usernames and passwords — and even brag about their digital misdeeds, Lane mentioned.
In addition they reward one another — providing a harmful “sense of camaraderie,” Lane mentioned — and so they put up pictures and movies of themselves enjoying with stacks of money, costly automobiles, and different tainted luxuries.
Matthew Lane is seen exhibiting off jewellery in a screengrab from a video he made in his freshman 12 months of school.
Matthew Lane
“You see this lavish, luxurious life-style,” Lane recalled. “As a younger child you are like, ‘I am gonna try this.’ And that is how I fell into it.”
Lane and others warn that on-line boards additionally appeal to felony teams searching for to recruit potential hackers.
“The unhealthy guys are on all of the platforms watching the youngsters enjoying,” Hay mentioned. “And once they see an elite-level performer, they go strategy that child, masquerading as one other child, and so they go, ‘Hey, you need to earn some [money]? … Listed below are the instruments, listed here are the strategies.'”
In an announcement to ABC Information, Roblox famous that cybercrime is “an industry-wide problem” and mentioned that the gaming platform routinely stories cyber-enabled crime to regulation enforcement. Roblox additionally mentioned it’s utilizing “leading edge anti-cheat techniques” to cease dishonest on its platform.
On Monday, Roblox introduced that, beginning in June, it would supply age-checked accounts for youthful customers that restrict what video games they will play, and add “extra intently align content material entry, communication settings, and parental controls with a consumer’s age.”
‘Incomparable to any drug’
Lane mentioned he was a prolific cyber felony by age 15, and normally directed his cyberattacks towards “huge, huge” targets.
“I might simply search ‘High Fortune 500 firms,'” he mentioned with an anxious snort.
He mentioned that 90% of the time, he and others he labored with gained “preliminary entry” to a goal’s system through the use of a “specially-curated instrument” that Lane helped construct, which might establish vulnerabilities on an internet site.
As soon as inside a goal’s system, he and the others would “unfold our sources to every a part of the web site or firm,” secretly stealing no matter information they might, he mentioned.
“After which [the final step] is ransom,” he mentioned.
In accordance with Lane, he spent his “ill-gotten features” on designer garments, diamond jewellery, DoorDash deliveries, Airbnb leases for him and his pals, and medicines — “a lot of medicine.”
He mentioned he would numb ever-present emotions of guilt with medicine — from high-potency marijuana to acid. But it surely was hacking that gave him the strongest excessive.
“It is indescribable the adrenaline you get if you do one thing like that,” he mentioned. “It is far more than driving 120 miles per hour. … Incomparable to any drug in any respect, as properly.”
Lane mentioned he was in a harmful and “disconnected” spiral, convincing himself over and over that in some unspecified time in the future he would both “find yourself lifeless” or determine a option to make himself cease — “and I did not do both of these.”
‘Destroy your organization’
By the autumn of 2024, Lane discovered the supply of his subsequent repair: Credentials stolen from a PowerSchool contractor had been accessible on-line.
They had been a gateway to a worldwide powerhouse, with PowerSchool working in about 90 international locations all over the world. PowerSchool had grow to be so influential that in 2023, its CEO was invited to talk on the White Home throughout an occasion selling cybersecurity in schooling.
In accordance with court docket paperwork, Lane used the contractor’s credentials to rummage by means of PowerSchool’s techniques undetected, and he leased a server in Ukraine, the place an alleged co-conspirator ultimately transferred important quantities of pupil and instructor information.
Then, in late December, PowerSchool obtained a collection of threatening messages claiming to be from a worldwide cybercrime syndicate. The threats vowed to launch the delicate private data of tens of hundreds of thousands of scholars — some as younger as 5 — if PowerSchool did not pay practically $3 million in cryptocurrency.
On this display screen seize from Google Maps Road View, PowerSchool headquarters is proven in Folsom, Calif.
Google Maps Road View
“[W]e totally intend to destroy your organization … if the ransom just isn’t paid,” mentioned one message. However the messages additionally assured PowerSchool that the stolen information can be erased as soon as the ransom was paid.
So PowerSchool paid the ransom, saying later that it was a “very troublesome” determination however that “it was our responsibility” to attempt to preserve the info from being made public.
In accordance with a PowerSchool spokesperson, “not all” of PowerSchool’s clients “had been affected” by the breach. However the spokesperson declined to say how many individuals had been impacted.
‘FBI! We have now a search warrant‘
The breach turned public in early January 2025, after PowerSchool started notifying sure faculty districts about it and oldsters throughout the nation began receiving warning letters concerning the breach from their kids’s colleges.
The FBI’s Cyber Activity Power in Boston, in the meantime, was devoting most of its sources to uncovering who was behind the breach, in response to Domin, the top of the duty power.
Inside weeks, the FBI discovered at the least one among them: a 19-year-old freshman at Assumption College in Worcester, Massachusetts.
At about 6:30 on a Tuesday morning final April, FBI brokers began banging on the door of Lane’s second-floor dorm room. “FBI! We have now a search warrant,” Lane recalled them shouting.
They seized his units and most of the luxurious gadgets he purchased with “soiled” cash, as he put it. He mentioned he felt a “wave of reduction.”
“I am truthfully grateful for the FBI,” he mentioned. “After they left, I used to be like, ‘It is over … I am finished with this.'”
However these impacted by the breach had been hardly finished with it.
Per week after the FBI search, faculty districts in North Carolina and as far north as Canada began receiving a brand new spherical of threatening messages, utilizing among the identical previously-stolen information to extort the colleges.
FBI Supervisory Particular Agent Doug Domin is seen on the FBI’s Boston discipline workplace.
ABC Information
It turned out that — regardless of earlier assurances on the contrary — what one state official described as a “rogue actor” tied to the unique breach secretly saved among the information. Lane mentioned he did not find out about that.
Domin mentioned these affected by the unique breach “should mitigate this problem for his or her total life.”
“They’ll be re-victimized each time that dataset present up within the wild,” he mentioned.
Within the wake of the breach, PowerSchool supplied two years’ value of credit-monitoring and id safety providers to involved clients.
“PowerSchool takes the accountability to guard pupil information privateness and to behave responsibly as information processors to colleges and districts extraordinarily critically,” the corporate’s spokesperson mentioned.
In his interview with ABC Information, Lane mentioned he now appreciates how a lot his actions impacted actual people — not simply faceless firms that he thought would “get bailed out” by insurance coverage.
He mentioned he thinks about IT staffers with households who needed to work extra time to “clear up after [my] mess.”
In June, Lane pleaded responsible to unlawfully accessing PowerSchool’s computer systems and to 3 different federal expenses, together with cyber extortion, stemming from a separate breach. A federal decide in Massachusetts sentenced him to 4 years in federal jail and ordered him to pay greater than $14 million in restitution.
‘Like a gun’
Throughout Lane’s sentencing listening to in November, the decide issued a stark warning about younger folks: “If we put the pc of their room, the cellphone of their hand, it is like a gun,” U.S. District Courtroom Decide Margaret Guzman mentioned.
The decide mentioned society should discover a option to “assist our youngsters … use pc expertise in methods which can be useful to society.”
That is precisely what The Hacking Video games, the European-based group of entrepreneurs and cybersecurity specialists, is making an attempt to do, with a deal with Era Z — particularly those that are neurodivergent like Lane.
“Neurodiversity is so fascinating as a result of it is usually been seen as a handicap,” Hay mentioned. “[But] neurodivergent folks … see options to puzzles that different folks do not see.”
In accordance with Hay, The Hacking Video games has developed “the world’s first” synthetic intelligence-backed aptitude take a look at that ties gaming prowess and neurodiversity to cybersecurity abilities, in an effort to establish future {industry} specialists. It is referred to as the “Hacking Aptitude AI Platform,” or “HAPTAI.”
“We’re trying on the unsuitable issues,” Hay mentioned of the cybersecurity {industry}. “What we’re not is, ‘How good are you at gaming? How good are you at hacking these video games? How neurodivergent are you?. … None of that information lives on LinkedIn. None of that information is in resumes.”
However these are simply the sorts of new hires who may also help expertise firms, intelligence companies, and monetary establishments “construct their partitions larger,” Hay mentioned.
Roblox mentioned it has employed “a number of younger folks” to assist safe its techniques after they participated in one other program, run by the San Francisco-based cybersecurity firm HackerOne, that pays cyber-skilled operators of all ages to establish safety gaps on sure public-facing web sites.
Specialists and authorities additionally agree that folks should play an vital position in preserving teen players away from cybercrime.
“Dad and mom want to know what their children are accessing, what platforms they’re on, placing obstacles up, placing timers on expertise,” Domin, the FBI official, mentioned.
However Hay insisted that folks have to do extra than simply watch what their kids are doing.
“You have to get in there and recreation with them,” he mentioned. “In the identical approach you may take your children out to the park to go and play soccer, or throw a ball, you have to get it in there and recreation with them, as a result of then you definately’ll perceive their tradition, how they speak to their pals, [and] who’s speaking to them.”
On this June 6, 2025, file picture, Matthew D. Lane of Sterling leaves the U.S. District Courthouse in Worcester, Mass.
Brad Petrishen/The Worcester Telegram & Gazette through USA In the present day Community through Imagn Photographs, FILE
As for Lane, he mentioned he desires to be “a cautionary story” for others.
“I hope I can persuade at the least one particular person to not go down my path,” he mentioned. “Even when it is one particular person, I would be completely satisfied, truthfully.”
Lane advised ABC Information that after working to enhance himself in jail, together with by enterprise remedy and advancing his schooling, he hopes to at some point work in cybersecurity.
In a message from jail final week, he mentioned that previously three months behind bars, “I’ve made extra progress concerning the development of my psychological well being [and] general being … than I’ve prior to now 6 years.”
“I used to be given a second likelihood at life,” he mentioned.
In the meantime, Domin mentioned the investigation into Lane’s co-conspirators “is ongoing.”
ABC Information’ Zoe Chevalier contributed to this report.
