Loading story…
Former Saydel Community School District IT employee Ezekiel Dean Potter was sentenced to 21 months in prison after prosecutors said he carried out a prolonged cyber sabotage campaign against the Iowa district following his April 2023 termination. Authorities said Potter kept access to more than 300 district credentials and, from May 2023 through January 2025, used them to delete accounts, take down the district’s Facebook page, interfere with Apple School Manager, target GoDaddy, and compromise Google/Gmail, PowerSchool Schoology, and other school services.
The intrusions locked teachers out of platforms, disrupted classrooms, and caused tens of thousands of dollars in losses, with reported direct costs exceeding $73,000 and restitution set at $59,668.81. Investigators tied the activity to Potter through forensic evidence including IP addresses linked to later employers, activity traced despite VPN use, and a USB drive containing spreadsheets of district usernames and passwords. Potter pleaded guilty in January 2026 to computer fraud charges under the Computer Fraud and Abuse Act and was also ordered to serve supervised release with computer-use monitoring conditions.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Potter was sentenced to 21 months in prison for the prolonged cyberattack campaign against Saydel Community School District. He was also ordered to pay $59,668.81 in restitution and serve supervised release with computer-use monitoring conditions.
In January 2026, Potter pleaded guilty to computer fraud charges under the Computer Fraud and Abuse Act for the attacks on his former employer.
From May 2023 through January 2025, Potter used retained credentials to target systems including Apple School Manager, Schoology, Gmail, GoDaddy, PowerSchool, and the district's Facebook account, causing teacher lockouts and classroom disruption. Investigators later tied some activity to IP addresses from Potter's later employers and recovered a USB drive containing district usernames and passwords.
The charging narrative described the unauthorized activity against Saydel Community School District as continuing through January 2025.
Prosecutors said Potter retained district credentials and began a prolonged unauthorized access and sabotage campaign against Saydel Community School District in May 2023. The activity included deleting accounts and disrupting district-managed services.
The former IT employee's employment with Saydel Community School District ended in April 2023, which preceded the later unauthorized activity against the district.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Matthew Lane, a Massachusetts student, pleaded guilty and was later sentenced in a federal case tied to the breach of education software provider **PowerSchool**, an intrusion U.S. authorities described as the largest cyberattack in U.S. education history. Prosecutors said Lane used stolen contractor credentials and vulnerability-scanning tools to access the company’s network, then threatened to publish sensitive records unless he was paid about **$2.85 million in Bitcoin**. The compromised data reportedly covered roughly **60 million students** and **10 million teachers**, including names, phone numbers, addresses, Social Security numbers and, in some cases, medical information. Authorities said Lane also extorted a separate telecommunications company for **$200,000** by threatening to release customer data. The case triggered ransom payments and White House Situation Room briefings, and investigators later found that some stolen PowerSchool data was allegedly retained by another actor and reused in follow-on extortion attempts against school districts. Lane received a **four-year federal prison sentence** and was ordered to pay more than **$14 million in restitution**, while U.S. investigators continue pursuing alleged co-conspirators.
Jun 29, 2026
An Ohio IT contractor, Maxwell Schultz, pleaded guilty to sabotaging his former employer's network after being fired, causing over $862,000 in damages. Schultz gained unauthorized access by impersonating another contractor, reset approximately 2,500 passwords using a PowerShell script, and attempted to cover his tracks by deleting system logs. The attack resulted in widespread employee downtime and disrupted customer service, with Schultz facing up to ten years in prison and a $250,000 fine upon sentencing. In a separate case, a technical manager at Dutch wind farm operator Nordex was sentenced to 120 hours of community service for secretly installing cryptocurrency mining rigs and Helium network nodes at two wind farm sites. The mining operation, discovered shortly after the company suffered a ransomware attack, exploited company resources and posed operational risks to the turbines. The employee was also ordered to pay restitution for the unauthorized use of company infrastructure. Both incidents highlight the ongoing threat posed by malicious insiders abusing privileged access for personal gain or retaliation.
Jun 29, 2026
Federal prosecutors in Maryland indicted former hospital pharmacist Matthew Bathula over an alleged eight-year campaign of unauthorized computer access tied to a Maryland medical system, identified in court records as **Company A** and reported to be the University of Maryland Medical Center. Investigators allege Bathula abused his role as a pharmacy clinical specialist from July 2016 through September 2024 to steal usernames, passwords, authentication cookies, images, videos, and other sensitive data from nearly 200 victims connected to the health system. According to the indictment, Bathula used keyloggers, cookie theft tools, mailbox rules, file masquerading, and later spyware to maintain covert access to employee and affiliate accounts, including **Gmail**, **Microsoft 365**, **Google Photos**, **iCloud Photos**, social media, dating apps, and home security systems. Prosecutors say the activity enabled prolonged surveillance and, between February 2023 and July 2024, included covert video recording of victims without consent; the FBI said it identified and notified 195 victims nationwide within four months. Bathula faces two counts of unauthorized access to a protected computer and one count of aggravated identity theft, with potential prison exposure of up to 17 years, while civil lawsuits by current and former employees allege negligence, negligent supervision, negligent security, and invasion of privacy.
Jun 29, 2026