On a recent Tuesday morning, 20-year-old Matthew Lane communicated with ABC News via text while being driven to a federal prison in Connecticut, where he is set to serve time. “It’s extremely sad, and I’m just scared,” he expressed in his message.
Just over a year prior, while still a minor, Lane was involved in what is regarded as the most significant cyberattack in the history of U.S. education—a data breach that raised alarm bells and led to high-level briefings with White House officials.
This breach affected PowerSchool, an education technology provider utilized by 80% of U.S. school districts. According to the Justice Department, it jeopardized the security of information belonging to 60 million children and 10 million educators.
The breach involved threats to disclose sensitive personal information such as social security numbers, birth dates, family details, academic records, and confidential medical data, ultimately forcing PowerSchool to pay millions in ransom.
In an exclusive interview with ABC News, Lane reflected on the heist and his life as a cybercriminal, stating, “I think I need to go to prison for what I did.” He described his actions as “disgusting” and “greedy,” attributing his behavior to personal insecurities and recognizing the moral wrongness of his choices.
Lane’s case illustrates a growing concern among cybersecurity experts and law enforcement about a new generation of tech-savvy youths who pose significant threats. “We’ve encountered cases where individuals as young as 14 have been interviewed by the FBI,” noted Supervisory Special Agent Doug Domin, who led the investigation into the PowerSchool breach.
Members of Generation Z, who have grown up with digital devices and online access, are particularly susceptible to the temptations of cybercrime. Fergus Hay, the CEO of “The Hacking Games,” a European organization focused on preventing youth involvement in cybercrime, explained that social media and gaming platforms can glamorize criminal behavior and provide easy access to hacking resources.
“A young person with limited technical skills can inflict greater harm than previous generations,” Hay remarked.
In September, law enforcement apprehended a 15-year-old boy from Illinois who allegedly orchestrated a significant cyberattack on Las Vegas casinos in 2023, resulting in reported losses exceeding $100 million for MGM Resorts. He is currently awaiting trial.
In the same month, the Justice Department announced the arrest of a 19-year-old British national, who, starting at age 16, was connected to a notorious international cyber gang responsible for hacking nearly 50 U.S. companies and over 60 others globally, extorting a total of $115 million. He has yet to be extradited.
Concerned about the future implications of such trends, Hay and his team of cybersecurity professionals—including a former FBI agent—have initiated an educational campaign aimed at Generation Z. This campaign is supported by a testing platform designed to identify overlooked talent for the cybersecurity sector.
“This young generation is like free-range chickens, lacking guidance and susceptible to bad habits,” Hay stated. “With the right mentorship, their skills can be harnessed positively.”
For Lane, however, such intervention arrived too late. “I couldn’t stop,” he admitted regarding his involvement in cybercrime. “I was addicted to hacking.”
Lane’s journey into the world of cybercrime began on Roblox, a popular online gaming platform among children and teenagers. By the age of 9 or 10, he was grappling with mental health challenges and what he later identified as autism. Feeling isolated at school, he sought refuge on Roblox.
There, he encountered cheaters who manipulated games for an advantage, sparking his desire to learn similar skills. This curiosity led him to online hacking forums, where seasoned hackers share knowledge, sell databases of stolen information, and boast about their exploits.
Lane noted that these forums foster a dangerous camaraderie, as users share images of extravagant lifestyles filled with cash and luxury items. “You see this lavish lifestyle,” he recalled. “As a young kid, you’re like, ‘I’m gonna do that.’ And that’s how I fell into it.”
He and others caution that these online spaces also attract criminal organizations looking to recruit budding hackers. “The bad actors are monitoring all platforms, watching kids play,” Hay warned. “When they identify a promising individual, they might approach them disguised as another youth, enticing them with offers of financial rewards and providing tools and techniques.”
In a response to ABC News, Roblox acknowledged that cybercrime presents an industry-wide issue and stated that it regularly reports such activities to law enforcement. The platform also mentioned its implementation of advanced anti-cheat systems to combat cheating.
On Monday, Roblox announced that starting in June, it will introduce age-verified accounts for younger users, limiting their access to certain games and enhancing content access, communication settings, and parental controls based on user age.
By age 15, Lane described himself as an active cybercriminal, often targeting “big, big” organizations. “I would just search ‘Top Fortune 500 companies,’” he said, laughing nervously.
