Loading threat actor…
Matthew Lane is a U.S.-based cybercriminal convicted for intrusions and extortion involving PowerSchool and a U.S. telecommunications company. Public reporting identifies him as a Massachusetts resident who pleaded guilty to cyber extortion, aggravated identity theft, and unauthorized access offenses tied to breaches that exposed large volumes of sensitive personal data, including records associated with K-12 students and school staff. The PowerSchool intrusion has been described by prosecutors as the largest known data breach involving American schoolchildren. Lane’s operations were financially motivated and centered on unauthorized access to victim environments, theft of sensitive data, and extortion through threats to publish stolen information unless payment was made. In the PowerSchool case, he allegedly demanded a multimillion-dollar ransom and the victim ultimately paid. Prosecutors also linked his conduct to a broader pattern of cyberattacks dating back to 2021. Known aliases include matthew_d_lane and Matthew Lane. The activity attributed to him is consistent with criminal intrusion and data-theft extortion rather than espionage or disruptive state-backed operations. High-confidence behaviors supported by reporting include initial access, credential theft or identity abuse associated with aggravated identity theft charges, data exfiltration, post-exploitation within compromised environments, and extortion based on stolen data.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Matthew Lane conducted a major data breach against PowerSchool, exposing data from 70 million students and faculty. He demanded a ransom of nearly $2.9 million, which was paid, and threatened to leak the data if not paid. He also breached a U.S. telecom firm and has a pattern of cyberattacks dating back to 2021.
Matthew Lane conducted cyber extortion and identity theft attacks against a US telecommunications company and a cloud-based software company (PowerSchool), compromising multiple companies since 2021.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.