“I’ve been hacked” is a more and more common refrain these days. You may be talking about a simple hack, like a compromised Facebook or email account, or a more critical breach into your bank account or credit card. The numbers illustrate the frightening reality for our personal information. In 2025, the Identity Theft Resource Center reported 3,322 data breaches, a new record, affecting more than 278 million people.

If you sometimes feel like your data is never safe, well, you may not be that far off the mark. Even our kids aren’t immune — in 2024, a major breach involving a company called PowerSchool exposed the personal details of about 60 million children and 10 million teachers. The culprit? A 19-year-old college student named Matthew Lane.

PowerSchool is a provider of cloud-based software that helps schools manage data, including attendance, grades, schedules, records, and more. It offers parent/student portals along with tools for both administrative functions and student life. Lane gained access to PowerSchool using credentials swiped from a contractor who worked with the company and stole sensitive records, including grades, discipline records, and personally identifiable information. And he didn’t stop there. He then demanded about $3 million from PowerSchool to delete the information, which the company paid because it thought it was the best way to keep the data private. Lane was caught mere months later — where is he today, and what implications does this breach have for the future?

While many of his peers were skipping class, Matthew Lane launched what’s been called an unprecedented breach of student personal information. About 80% of school districts in the U.S. use PowerSchool, and leaked data included social security numbers, birth dates, medical information, and more. Lane, who later stated that he was addicted to hacking, was sentenced to four years in federal prison and three years of supervised release. He later told ABC News he was thankful to the FBI for catching him and agreed with the punishment.

The incident was not the first for Lane, who allegedly targeted other companies and even foreign governments when he was only in high school. He also enjoyed the spoils of his crimes, spending money on clothing, jewelry, vehicles, and more. And while it’s easy to make jokes about the mischief that teenagers typically get into, the average age of cybercriminals is only 19 years old, the same age as Lane when he gained access to PowerSchool.

In response to the breach, PowerSchool offered a complimentary identity protection service to affected individuals, but many individual school districts received ransom demands months after the initial breach. In addition to prison time, Lane was ordered to pay $14.1 million in restitution and a $25,000 fine. PowerSchool is facing multiple lawsuits, and the breach is yet another example of how vulnerable our personal information is online. Lane hopes to one day work with kids to help them avoid the same mistakes he made, but as we move further into the digital age, experts recommend using strong, unique passwords; using two-factor authentication, even if it’s not foolproof; and freezing accounts when necessary.