On a current Tuesday morning, as his mother and father had been driving him to the federal jail in Connecticut the place he’ll be locked up for the foreseeable future, 20-year-old Matthew Lane despatched a textual content message to ABC Information.
“It is extraordinarily unhappy, and I am simply scared,” he wrote.
Barely a yr earlier, whereas nonetheless a teen, he helped launch what’s been described as the largest cyberattack in U.S. training historical past — a knowledge breach that involved authorities a lot, it prompted briefings with senior authorities officers contained in the White Home Scenario Room.
The breach pierced the training expertise firm PowerSchool — utilized by 80% of faculty districts in North America — and “put in danger the safety of 60 million kids and 10 million lecturers,” the Justice Division mentioned.
With threats to show social safety numbers, dates of delivery, household info, grades, and even confidential medical info, the breach cornered PowerSchool into paying tens of millions of {dollars} in ransom.
“I believe I must go to jail for what I did,” Lane advised ABC Information in an unique interview, talking publicly for the primary time concerning the headline-grabbing heist and his life as a cybercriminal.
“It was disgusting, it was grasping, it was rooted in my very own insecurities, it was unsuitable in each facet,” he mentioned within the interview, two days earlier than reporting to jail.
Matthew Lane seems to be out a window in Worcester, Massachusetts, two days earlier than reporting to federal jail.
ABC Information
Lane is only one instance of what cybersecurity consultants, authorities and even Lane himself say is a wide-ranging menace: a brand new era of tech-savvy youngsters who’re uniquely harmful and surprisingly younger.
“We have labored instances the place people as younger as 14 are being interviewed by the FBI,” mentioned Supervisory Particular Agent Doug Domin, who oversaw the PowerSchool investigation out of the FBI’s Boston subject workplace.
Members of Era Z — who’ve had digital units and the Web of their lives since delivery — are notably weak to the attract of cybercrime as a result of the social media platforms they inhabit can glorify “a legal life-style”; the gaming platforms they frequent can increase their “hacker talent units”; and the expertise used for hacking is “so accessible,” in keeping with Fergus Hay, the CEO of a European-based group referred to as “The Hacking Video games” that is now working to maintain children all over the world out of cybercrime.
“So a youngster with much less technical expertise can do extra injury than a earlier era,” Hay mentioned.
In September, authorities arrested a boy from Illinois who in 2023, at age 15, allegedly launched a devastating cyberattack on Las Vegas casinos that reportedly value MGM Resorts alone greater than $100 million. He’s awaiting trial.
The identical month, the Justice Division introduced the abroad arrest of a 19-year-old British nationwide who, beginning at age 16, allegedly helped a infamous worldwide cybergang hack into the networks of almost 50 U.S. firms and greater than 60 others all over the world, extorting them out of $115 million in whole. He has but to be extradited.
Fergus Hay, the CEO of The Hacking Video games, speaks to highschool college students in Manchester, England.
ABC Information
Hay and his group of entrepreneurs and cybersecurity consultants, which features a former FBI agent, say they’re so involved about what might be coming subsequent that they’ve launched an training and media marketing campaign focusing on Era Z, backed by a testing platform they developed to determine what they are saying is often-overlooked expertise for the cybersecurity subject.
“You have obtained this complete younger era who’re like free-range chickens on the market,” Hay mentioned. “Below no steerage, they’ll fall into actually, actually dangerous habits. Below the fitting steerage, you’ll be able to take this era and use their expertise [positively].”
For Lane, such intervention got here too late.
“I could not cease,” he mentioned of his cyber crimes. “I used to be hooked on hacking.”
‘That is how I fell into it’
In line with Lane, his story started on Roblox, the colossal on-line gaming platform well-liked with kids and youths.
As he remembers it, by the point he was 9 or 10 years previous, he was struggling along with his psychological well being and what he later would be taught was autism. He mentioned he felt “completely different” and like “an outcast” in school, so he discovered “solace” on Roblox.
However on Roblox he additionally discovered cheaters — individuals who may reprogram video games to realize a bonus — and he needed to determine how to do this too, he mentioned.
That led him to a world of on-line “hacking boards,” the place completed hackers not solely share commerce secrets and techniques but in addition promote huge databases of stolen info — together with hijacked usernames and passwords — and even brag about their digital misdeeds, Lane mentioned.
In addition they reward one another — providing a harmful “sense of camaraderie,” Lane mentioned — they usually publish pictures and movies of themselves enjoying with stacks of money, costly automobiles, and different tainted luxuries.
Matthew Lane is seen displaying off jewellery in a screengrab from a video he made in his freshman yr of school.
Matthew Lane
“You see this lavish, luxurious life-style,” Lane recalled. “As a younger child you are like, ‘I am gonna do this.’ And that is how I fell into it.”
Lane and others warn that on-line boards additionally appeal to legal teams searching for to recruit potential hackers.
“The dangerous guys are on all of the platforms watching the children enjoying,” Hay mentioned. “And once they see an elite-level performer, they go strategy that child, masquerading as one other child, they usually go, ‘Hey, you need to earn some [money]? … Listed here are the instruments, listed here are the methods.'”
In a press release to ABC Information, Roblox famous that cybercrime is “an industry-wide problem” and mentioned that the gaming platform routinely experiences cyber-enabled crime to regulation enforcement. Roblox additionally mentioned it’s utilizing “innovative anti-cheat methods” to cease dishonest on its platform.
On Monday, Roblox introduced that, beginning in June, it’ll supply age-checked accounts for youthful customers that restrict what video games they’ll play, and add “extra intently align content material entry, communication settings, and parental controls with a consumer’s age.”
‘Incomparable to any drug’
Lane mentioned he was a prolific cyber legal by age 15, and normally directed his cyberattacks towards “massive, massive” targets.
“I might simply search ‘High Fortune 500 firms,'” he mentioned with an anxious chortle.
He mentioned that 90% of the time, he and others he labored with gained “preliminary entry” to a goal’s system through the use of a “specially-curated device” that Lane helped construct, which may determine vulnerabilities on an internet site.
As soon as inside a goal’s system, he and the others would “unfold our assets to every a part of the web site or firm,” secretly stealing no matter knowledge they might, he mentioned.
“After which [the final step] is ransom,” he mentioned.
In line with Lane, he spent his “ill-gotten features” on designer garments, diamond jewellery, DoorDash deliveries, Airbnb leases for him and his associates, and medicines — “plenty of medication.”
He mentioned he would numb ever-present emotions of guilt with medication — from high-potency marijuana to acid. But it surely was hacking that gave him the strongest excessive.
“It is indescribable the adrenaline you get if you do one thing like that,” he mentioned. “It is far more than driving 120 miles per hour. … Incomparable to any drug in any respect, as effectively.”
Lane mentioned he was in a harmful and “disconnected” spiral, convincing himself again and again that sooner or later he would both “find yourself useless” or determine a solution to make himself cease — “and I did not do both of these.”
‘Destroy your organization’
By the autumn of 2024, Lane discovered the supply of his subsequent repair: Credentials stolen from a PowerSchool contractor had been accessible on-line.
They had been a gateway to a world powerhouse, with PowerSchool working in about 90 international locations all over the world. PowerSchool had develop into so influential that in 2023, its CEO was invited to talk on the White Home throughout an occasion selling cybersecurity in training.
In line with courtroom paperwork, Lane used the contractor’s credentials to rummage by PowerSchool’s methods undetected, and he leased a server in Ukraine, the place an alleged co-conspirator ultimately transferred vital quantities of pupil and instructor knowledge.
Then, in late December, PowerSchool obtained a sequence of threatening messages claiming to be from a world cybercrime syndicate. The threats vowed to launch the delicate private info of tens of tens of millions of scholars — some as younger as 5 — if PowerSchool did not pay almost $3 million in cryptocurrency.
On this display screen seize from Google Maps Avenue View, PowerSchool headquarters is proven in Folsom, Calif.
Google Maps Avenue View
“[W]e absolutely intend to destroy your organization … if the ransom will not be paid,” mentioned one message. However the messages additionally assured PowerSchool that the stolen knowledge could be erased as soon as the ransom was paid.
So PowerSchool paid the ransom, saying later that it was a “very troublesome” determination however that “it was our responsibility” to attempt to maintain the info from being made public.
In line with a PowerSchool spokesperson, “not all” of PowerSchool’s prospects “had been affected” by the breach. However the spokesperson declined to say how many individuals had been impacted.
‘FBI! We have now a search warrant‘
The breach grew to become public in early January 2025, after PowerSchool started notifying sure faculty districts about it and fogeys throughout the nation began receiving warning letters concerning the breach from their kids’s faculties.
The FBI’s Cyber Job Pressure in Boston, in the meantime, was devoting most of its assets to uncovering who was behind the breach, in keeping with Domin, the pinnacle of the duty power.
Inside weeks, the FBI found out a minimum of certainly one of them: a 19-year-old freshman at Assumption College in Worcester, Massachusetts.
At about 6:30 on a Tuesday morning final April, FBI brokers began banging on the door of Lane’s second-floor dorm room. “FBI! We have now a search warrant,” Lane recalled them shouting.
They seized his units and lots of the luxurious gadgets he purchased with “soiled” cash, as he put it. He mentioned he felt a “wave of aid.”
“I am truthfully grateful for the FBI,” he mentioned. “After they left, I used to be like, ‘It is over … I am accomplished with this.'”
However these impacted by the breach had been hardly accomplished with it.
Every week after the FBI search, faculty districts in North Carolina and as far north as Canada began receiving a brand new spherical of threatening messages, utilizing a number of the identical previously-stolen knowledge to extort the faculties.
FBI Supervisory Particular Agent Doug Domin is seen on the FBI’s Boston subject workplace.
ABC Information
It turned out that — regardless of earlier assurances on the contrary — what one state official described as a “rogue actor” tied to the unique breach secretly stored a number of the knowledge. Lane mentioned he did not learn about that.
Domin mentioned these affected by the unique breach “should mitigate this challenge for his or her total life.”
“They’ll be re-victimized each time that dataset present up within the wild,” he mentioned.
Within the wake of the breach, PowerSchool supplied two years’ price of credit-monitoring and id safety companies to involved prospects.
“PowerSchool takes the duty to guard pupil knowledge privateness and to behave responsibly as knowledge processors to colleges and districts extraordinarily significantly,” the corporate’s spokesperson mentioned.
In his interview with ABC Information, Lane mentioned he now appreciates how a lot his actions impacted actual people — not simply faceless firms that he thought would “get bailed out” by insurance coverage.
He mentioned he thinks about IT staffers with households who needed to work additional time to “clear up after [my] mess.”
In June, Lane pleaded responsible to unlawfully accessing PowerSchool’s computer systems and to 3 different federal expenses, together with cyber extortion, stemming from a separate breach. A federal choose in Massachusetts sentenced him to 4 years in federal jail and ordered him to pay greater than $14 million in restitution.
‘Like a gun’
Throughout Lane’s sentencing listening to in November, the choose issued a stark warning about younger folks: “If we put the pc of their room, the telephone of their hand, it is like a gun,” U.S. District Court docket Choose Margaret Guzman mentioned.
The choose mentioned society should discover a solution to “assist our kids … use pc expertise in methods which are useful to society.”
That is precisely what The Hacking Video games, the European-based group of entrepreneurs and cybersecurity consultants, is making an attempt to do, with a deal with Era Z — particularly those that are neurodivergent like Lane.
“Neurodiversity is so fascinating as a result of it is typically been seen as a handicap,” Hay mentioned. “[But] neurodivergent folks … see options to puzzles that different folks do not see.”
In line with Hay, The Hacking Video games has developed “the world’s first” synthetic intelligence-backed aptitude check that ties gaming prowess and neurodiversity to cybersecurity expertise, in an effort to determine future {industry} consultants. It is referred to as the “Hacking Aptitude AI Platform,” or “HAPTAI.”
“We’re wanting on the unsuitable issues,” Hay mentioned of the cybersecurity {industry}. “What we’re not taking a look at is, ‘How good are you at gaming? How good are you at hacking these video games? How neurodivergent are you?. … None of that knowledge lives on LinkedIn. None of that knowledge is in resumes.”
However these are simply the forms of new hires who may help expertise firms, intelligence businesses, and monetary establishments “construct their partitions larger,” Hay mentioned.
Roblox mentioned it has employed “a number of younger folks” to assist safe its methods after they participated in one other program, run by the San Francisco-based cybersecurity firm HackerOne, that pays cyber-skilled operators of all ages to determine safety gaps on sure public-facing web sites.
Specialists and authorities additionally agree that folks should play an essential function in protecting teen avid gamers away from cybercrime.
“Dad and mom want to know what their children are accessing, what platforms they’re on, placing boundaries up, placing timers on expertise,” Domin, the FBI official, mentioned.
However Hay insisted that folks must do extra than simply watch what their kids are doing.
“You have to get in there and recreation with them,” he mentioned. “In the identical approach you may take your children out to the park to go and play soccer, or throw a ball, you have to get it in there and recreation with them, as a result of then you definately’ll perceive their tradition, how they discuss to their associates, [and] who’s speaking to them.”
On this June 6, 2025, file picture, Matthew D. Lane of Sterling leaves the U.S. District Courthouse in Worcester, Mass.
Brad Petrishen/The Worcester Telegram & Gazette by way of USA At present Community by way of Imagn Photos, FILE
As for Lane, he mentioned he desires to be “a cautionary story” for others.
“I hope I can persuade a minimum of one individual to not go down my path,” he mentioned. “Even when it is one individual, I would be joyful, truthfully.”
Lane advised ABC Information that after working to enhance himself in jail, together with by enterprise remedy and advancing his training, he hopes to sooner or later work in cybersecurity.
In a message from jail final week, he mentioned that previously three months behind bars, “I’ve made extra progress concerning the development of my psychological well being [and] general being … than I’ve up to now 6 years.”
“I used to be given a second probability at life,” he mentioned.
In the meantime, Domin mentioned the investigation into Lane’s co-conspirators “is ongoing.”
ABC Information’ Zoe Chevalier contributed to this report.
