WORCESTER—A 19-year-old Assumption University student from Sterling has been charged—and has agreed to plead guilty—in connection with a hacking and extortion scheme that targeted two U.S. companies and compromised millions of personal records, federal prosecutors announced Thursday.
Matthew D. Lane is accused of participating in a cyber extortion conspiracy between April and May of 2024, during which he and unnamed co-conspirators allegedly gained unauthorized access to sensitive company data and demanded ransom payments in exchange for not leaking the information.
According to the U.S. Attorney’s Office for the District of Massachusetts, Lane faces charges of cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers, and aggravated identity theft. A date for his plea hearing has not yet been set.
“Cyber extortion is a serious attack on our economy and on all of us,” U.S. Attorney Leah B. Foley said in the announcement. “As alleged, this defendant stole private information about millions of children and teachers, imposed substantial financial costs on his victims, and instilled fear in parents that their kids’ information had been leaked into the hands of criminals – all to put a notch in his hacking belt.”
Prosecutors say Lane first targeted a telecommunications company, threatening to release previously stolen customer data unless the company paid $200,000. When the company questioned the effectiveness of paying a ransom, Lane allegedly replied: “We are the only ones with a copy of this data now. Stop this nonsense [or] your executives and employees will see the same fate . . . . Make the correct decision and pay the ransom. If you keep stalling, it will be leaked.”
Lane also allegedly used stolen credentials to access the networks of a software and cloud storage company that serves school districts across North America. He is accused of transferring confidential student and teacher data to a leased server in Ukraine. That data reportedly included names, Social Security numbers, contact details, birthdates, medical information, and login credentials.
A subsequent threat warned that if the company did not pay approximately $2.85 million in Bitcoin, the personal data of more than 60 million students and 10 million teachers would be leaked globally.
“This alleged scheme has resulted in serious consequences and highlights the FBI’s ongoing commitment to bringing cyber criminals to justice,” said Kimberly Milka, Acting Special Agent in Charge of the FBI’s Boston Division. “Matthew Lane apparently thought he found a way to get rich quick, but this 19-year-old now stands accused of hiding behind his keyboard to gain unauthorized access to sensitive data.”
Anyone concerned that a specific student or teacher may have been affected should contact their local school district, the release said.
The charges each carry a potential sentence of up to five years in prison and significant fines, while the identity theft charge requires a mandatory additional two years in prison if convicted.
Have news, tips, or a story worth telling? Reach Editor Charlene Arsenault at carsenault@theworcesterguardian.org—because good stories (and great scoops) deserve to be shared.
- The Worcester Guardian is an independent nonprofit news organization. Support local journalism by making a DONATION today.
