被指入侵 PowerSchool 窃走逾6000万名学生数据勒索比特币：19岁大学生同意认罪
美国司法部2025年5月20日宣布，马萨诸塞州伍斯特县 Sterling 的19岁大学生 Matthew D. Lane 已被起诉并同意认罪。检方指其入侵两家美国公司的计算机网络、窃取数据并索要赎金。Lane 就读于伍斯特（Worcester）的 Assumption University，他同意就网络勒索共谋、网络勒索、未经授权访问受保护计算机与加重身份盗窃四项罪名各认一项；认罪听证的日期当时尚未由法院排定。
检方指，第一起勒索发生在2024年4月至5月：Lane 与同伙以公开先前从一家电信公司网络窃得的客户数据相威胁，索要20万美元赎金。当该公司质疑付款是否真能终止泄露威胁时，Lane 被指回复说：「现在只有我们手里有这份数据的副本。别再胡闹了，否则你们的高管和员工也会落得同样下场。做对决定，把赎金付了。再拖下去，数据就会被泄露。」
第二起规模大得多。检方指，Lane 使用窃得的登录凭据，侵入第二家受害公司的网络，把该公司网络上学生与教师的个人身份信息传到他在乌克兰租用的一台计算机服务器上。这家公司是为美国、加拿大等地学校系统提供软件与云存储服务的供应商。其后，该公司等收到威胁：逾6,000万名学生与1,000万名教师的个人信息，包括姓名、电邮、电话号码、社会安全号码、出生日期、医疗信息、住址、家长与监护人信息及密码等，若不支付约285万美元比特币赎金，就会被「泄露到全世界」。
检方的起诉文件没有点名两家受害公司。据路透社2025年5月20日报道，一名知情人士确认，第二家公司就是总部位于加州 Folsom 的教育软件公司 PowerSchool；该公司于2025年1月披露其系统曾遭入侵。马萨诸塞区联邦检察官 Leah B. Foley 说，这名被告被指窃走数百万儿童与教师的私人信息、给受害公司造成重大财务损失，还让家长们担心孩子的信息已落入罪犯之手，这一切「不过是为在自己的黑客履历上添一笔」。
联邦调查局 Boston 分局代理特别探员主管 Kimberly Milka 说，Lane 被指躲在键盘后面，未经授权进入一家教育软件供应商的系统取得敏感数据、企图勒索数百万美元，还被指共谋就一家电信供应商的机密数据索要更多赎金。本案由助理联邦检察官 Kristen A. Kearney 承办，Assumption University 警局提供了协助。
按检方公布的量刑规定，网络勒索共谋、网络勒索与未经授权访问受保护计算机三项罪名，每项最高可判5年监禁、3年监督释放与最高25万美元或违法所得、损失两倍中较高者的罚款；加重身份盗窃罪则须在计算机犯罪刑期之外另加连续执行的2年强制监禁。起诉文件中的细节仅为指控，被告在被法庭以排除合理怀疑的标准定罪之前推定无罪。（来源：美国司法部马萨诸塞区联邦检察官办公室）
College Student Agrees to Plead Guilty in PowerSchool Case: Prosecutors Say Data on More Than 60 Million Students Was Held for a Bitcoin Ransom
The Justice Department announced on May 20, 2025, that Matthew D. Lane, 19, of Sterling, in Worcester County, Massachusetts, had been charged and had agreed to plead guilty in connection with hacking into the computer networks of two U.S.-based companies and extorting the companies for ransoms. Lane, a student at Assumption University in Worcester, agreed to plead guilty to one count each of cyber extortion conspiracy, cyber extortion, unauthorized access to protected computers, and aggravated identity theft. A plea hearing had not yet been scheduled by the court.
According to court filings, the first extortion ran from April 2024 to May 2024, when Lane allegedly agreed with others to extort a $200,000 ransom payment from a telecommunications company by threatening to publicly disseminate customer data previously stolen from the company's network. When the company questioned whether paying would in fact end the threat, Lane allegedly responded: "We are the only ones with a copy of this data now. Stop this nonsense [or] your executives and employees will see the same fate. Make the correct decision and pay the ransom. If you keep stalling, it will be leaked."
The second scheme was far larger. Prosecutors allege that Lane used stolen login credentials to access the network of a second victim company, a software and cloud storage company that served school systems in the United States, Canada, and elsewhere, and caused students' and teachers' personally identifying information stored on that network to be transferred to a computer server he leased in Ukraine. The company and others then received threats that the personal information of more than 60 million students and 10 million teachers, including names, email addresses, phone numbers, Social Security numbers, dates of birth, medical information, residential addresses, parent and guardian information, and passwords, would be "leaked worldwide" if a ransom of approximately $2.85 million in Bitcoin was not paid.
The charging documents did not name either victim company. Reuters reported on May 20, 2025, that a person familiar with the matter confirmed the second company was PowerSchool, the education software company based in Folsom, California, which had disclosed in January 2025 that its systems were breached. U.S. Attorney Leah B. Foley said the defendant allegedly stole private information about millions of children and teachers, imposed substantial financial costs on his victims, and instilled fear in parents that their children's information had leaked into the hands of criminals, all, she said, "to put a notch in his hacking belt."
Kimberly Milka, Acting Special Agent in Charge of the FBI's Boston Division, said Lane allegedly hid behind his keyboard to gain unauthorized access to an education software provider to obtain sensitive data used in an attempt to extort millions of dollars, and also allegedly conspired to extort more money from a telecommunications provider over its confidential data. Assistant U.S. Attorney Kristen A. Kearney of the Securities, Financial & Cyber Fraud Unit is prosecuting the case, and the Assumption University Police Department provided valuable assistance.
The charges of cyber extortion conspiracy, cyber extortion, and unauthorized access to protected computers each carry a sentence of up to five years in prison, three years of supervised release, and a fine of up to $250,000, or twice the gross gain or loss, whichever is greater. Aggravated identity theft carries a mandatory two-year prison sentence consecutive to any sentence on the computer charges. The details contained in the charging document are allegations, and the defendant is presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law. (Source: U.S. Attorney's Office for the District of Massachusetts)
来源：美国司法部马萨诸塞区联邦检察官办公室
发布：GSM·美国（发布链接）
图片来源：图：位于马萨诸塞州伍斯特（Worcester）的 Harold D. Donohue 联邦大楼暨美国联邦法院（资料图），本案起诉书即向马萨诸塞联邦地区法院伍斯特法庭提交。Pvmoutside 摄，CC BY-SA 3.0，经 Wikimedia Commons。 / Photo: The Harold D. Donohue Federal Building and United States Courthouse in Worcester, Massachusetts (file photo); the charges were filed in the Worcester court of the U.S. District Court for the District of Massachusetts. By Pvmoutside, CC BY-SA 3.0, via Wikimedia Commons.
GSM Global · 本篇英文版 English edition of this story
