Massachusetts College Student Pledges Guilty to Extortion and Identity Theft

A 19-year-old college student from Massachusetts has pleaded guilty to stealing millions of students' and teachers' private data from two major education tech companies, extorting it for ransom. Matthew Lane, a student at Assumption University, faces serious charges that have sent shockwaves through the cybersecurity community.

The Scope of the Breach

According to court records, Lane allegedly gained unauthorized access to the computer network of a software and cloud storage company serving school systems in the US and abroad. The exact identity of the company has not been disclosed, but a source familiar with the case has confirmed its involvement.

Lane is accused of stealing login credentials to gain control over the system, allowing him to access sensitive data from millions of students and teachers. This information included names, phone numbers, Social Security numbers, residential addresses, and medical histories. The total amount of stolen data is staggering, with approximately 60 million student records and 10 million teacher records compromised.

The Extortion Demand

Lane allegedly threatened to release the stolen data unless the company paid a ransom of around $2.85 million in Bitcoin. This demand was part of a broader scheme that saw Lane extorting another telecommunications company for $200,000 by threatening to release customer data.

A Pattern of Exploitation

According to Kimberly Milka, Acting Special Agent in Charge of the FBI's Boston Division, "Matthew Lane apparently thought he found a way to get rich quick, but this 19-year-old now stands accused of hiding behind his keyboard to gain unauthorized access to an education software provider to obtain sensitive data which was used in an attempt to extort millions of dollars."

A Threat to Public Trust

US Attorney Leah B. Foley noted that Lane's actions "instilled fear in parents that their kids' information had been leaked into the hands of criminals – all to put a notch in his hacking belt." This highlights the severity of the situation, as millions of people had their private data compromised due to Lane's actions.

The Consequences

Lane faces multiple charges, including cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers, and aggravated identity theft. A plea hearing has not yet been scheduled, but the consequences for his actions are clear: he must answer to the law for his crimes.

A Cautionary Tale

This case serves as a reminder of the importance of cybersecurity and data protection in today's digital age. It also highlights the devastating consequences that can result from individuals exploiting vulnerabilities in systems and stealing sensitive information.