Minor Mayhem: The Hackers of Gen Z - Part 1

[0:05] I need my punishment. I wouldn't say everyone needs prison, but I think I need to go to prison. [0:11] I did. Matthew D. Lane. [0:15] Shortly after graduating high school, this Massachusetts teenager, Matthew Lane, [0:19] helped launch what's been called the biggest cyber attack in U.S. education history. [0:25] Potentially concerning news for parents. [0:27] The power school data breach. [0:28] One of the largest student information systems in the world that has potentially exposed the personal information of millions upon millions. [0:37] The company reportedly paid close to $3 million in ransom to recover the private information of 60 million students that Matthew helped compromise. [0:46] I definitely knew what I was doing. In the spectrum of hackers, like, like here. [0:52] Matthew, now just 20 years old, sat down with ABC News for an exclusive interview two days before reporting to federal prison. [1:00] I'm going to take my punishment. [1:02] Are you not scared? [1:04] Yeah, of course I'm scared. [1:06] For Matthew and so many others like him, his gateway to cybercrime was a gaming platform that most teenagers know, Roblox. [1:15] Here, every game is built by the community. [1:18] It's an online space where gamers can connect with players from all around the world and even create their own games. [1:24] It wasn't until I was like 13, 14, a friend that I knew, he put me on the Roblox shooting program. [1:32] And then I started to get into that and just kind of spiraled from there, honestly. [1:37] The bad guys are on all the platforms watching the kids playing. [1:41] And when they see an elite level performer, they go approach that kid masquerading as another kid. [1:46] And they go, hey, you want to earn some crypto? [1:48] Here are the tools. [1:49] Here are the techniques. [1:50] Tonight, the story of two hackers who, as teens, fell into a life of cybercrime, whether by stealing directly from people's accounts. [1:59] How much money are we talking about here? [2:01] Well, like $8 million. [2:03] $8 million. [2:04] Yeah. [2:05] Or by holding their data hostage in exchange for money. [2:08] It's easy. [2:09] Easy money, even though it's dirty. [2:11] Though these crimes started with gaming, the real-life consequences are no child's play. [2:16] One still so young, just starting to face his punishment. [2:20] The other now working to stop teens before it's too late. [2:24] They get a little bit of money and they think, like, they're on top of the world. [2:27] Like, they think, like, they're in, like, Scarface movie or something, and they're not. [2:34] Experts warn this new generation of cybercriminals is uniquely dangerous and shockingly young, chasing money, status, and their next thrill. [2:44] It's way more than driving 120 miles per hour on, like, a back road or a highway, incomparable to any drug at all as well. [2:53] Individuals as young as 14 are being interviewed by the FBI. [2:56] The cases are startling. [2:58] From a 17-year-old who hijacked the social media accounts of Barack Obama, Kim Kardashian, Jeff Bezos, and others, [3:04] to the 15-year-old hacker who allegedly cost major Las Vegas casinos more than $100 million. [3:10] Another team said hacking was his hobby before breaking into thousands of platforms at the massive sports betting platform DraftKings [3:20] and stealing hundreds of thousands of dollars. [3:23] When was the last time you hacked someone's account? [3:26] Less than a week ago. [3:28] Here he is being questioned by police about his years of hacking. [3:33] Do your parents know a fraction of this? [3:41] How do you think they're going to react? [3:44] You're not the best. [3:45] Average age of someone arrested for serious crime is 34 years old. [3:50] Average age of someone arrested for cybercrime is 19 years old. [3:55] There was the 19-year-old New Yorker who, from inside his parents' house, [3:59] founded one of the world's leading hacker forums, a global market for stolen data that Matthew Lane frequented. [4:06] It was called Breach Forums, and that's where everyone flocked to. [4:08] The FBI nabbing its founder in an elaborate route. [4:16] Parents need to plug in. Parents need to lock in. Parents need to understand the world that their kids are living in. [4:23] Understand the threat of their kid being groomed from their bedroom. [4:27] That's what happened to Matthew Lane. He says he had a happy childhood and a loving family. [4:32] But in his teens, he says he started to struggle with mental health, and what he later learned was autism. [4:38] And that kind of made me feel like an outcast. I went to go find solace in other things. [4:44] You know, I was gaming, and I was playing Roblox, and I was involved in the game cheating community. [4:51] Roblox says it uses cutting-edge technology to fight cheating, but Matthew still found it, [4:57] and then a bigger hacking world online, where cybercriminals boldly boast of their latest heists and their lavish lives. [5:03] And you're like, as a young kid, like, I want that. And then that's what leads you down to the path of greed. [5:12] The hacker in him was merciless and methodical. [5:15] We would try to get an initial access, and then next step, privilege escalation. [5:19] Next step was exfiltration, and then four is ransom. [5:23] I would just search top fortune 500 companies. [5:28] As his targets got bigger, so too did his profits. [5:32] So I was spending a lot on designer clothes, diamond jewelry. [5:36] The big thing was the drugs. [5:39] Lots of drugs. [5:41] Lots of, lots, lots. [5:43] High-potency marijuana. [5:45] Magic mushrooms, acid, stuff like that. [5:48] I felt like I was a zombie. [5:49] I was disconnected. [5:51] But nothing I felt like I was doing was real, even though it was. [5:55] It was a bad era in my life. [5:57] But he says the ultimate high came from hacking. [5:59] I was addicted to hacking. That gave me the most natural high ever. [6:05] In the summer of 2024, Matthew set his sights on the target that would be his downfall. [6:10] A student-teacher portal used by 80% of school districts across North America. [6:16] Only PowerSchool can bring together the information that connects educators, administrators, and families. [6:23] It was one of the worst I've seen here when you talk about financial impact. [6:26] These other victims are going to have a lifetime of defending themselves and having to mitigate risk of their information being out there. [6:34] Agent Doug Doman has been with the FBI for more than two decades. [6:38] He oversaw the criminal investigation. [6:40] He says the type of information compromised in the hack was alarming. [6:45] In some cases, social security numbers. [6:47] In some cases, it was date of birth and names. [6:50] In others, it was all of that, plus addresses, grades. [6:54] A former official said the breach was so concerning that the White House convened two briefings on it inside the Situation Room. [7:02] According to court documents, someone tied to the breach used stolen PowerSchool data as leverage, [7:07] threatening in a message to destroy your company and bankrupt it to the point of no absolute return, [7:13] if the company didn't pay nearly $3 million in Bitcoin. [7:18] The data was exfiltrated to a server in Ukraine. [7:21] I'm assuming it's because they knew it would be more difficult for U.S. law enforcement to get access to. [7:28] PowerSchool did pay a ransom, later saying it did it in the best interest of its customers [7:33] and would pay for identity protection services. [7:36] In a statement to ABC News, the company said not all PowerSchool customers were affected [7:40] and they have remained focused on safeguarding student, family and educator data. [7:46] I wasn't really thinking about the individual. [7:48] I was just thinking, oh, these are companies, they got insurance, they'll get bailed out. [7:57] Our colleagues at WLS in Chicago speaking to one family potentially impacted by the data breach. [8:02] As my kids start to get older or start to think about college and they want, say, a credit card, [8:08] we just wouldn't know if something's already been opened in their name [8:12] or under their social security number until we go to take those actions. [8:17] Matthew continued his cybercrimes, keeping it all a secret while trying to live his day-to-day life as a college student. [8:23] My mentality was I was going to end up dead for whatever reason, you know, [8:29] or I was going to just somehow make myself stop and I didn't do either of those. [8:39] The FBI working behind the scenes to connect the dots. [8:43] We're starting to put a picture together of who this individual is, who he's working with. [8:48] The smoking gun for investigators, that server in Ukraine. [8:52] We saw that the server had been purchased with cryptocurrency, [8:56] that we were able to tie to Matt Lane's true name in a financial account that he had been using. [9:03] And when that happened, that's what clicked for us, that's what broke the case. [9:07] Coming up, the FBI raid that changes everything. [9:10] I get a bang on my door at 6.30. [9:13] Plus, the man tried to save teens from the life of crime he once led. [9:20] And the surprising thing parents can do to protect their kids.