DETROIT, Mich. — Matthew Weiss, a former co-offensive coordinator for the University of Michigan football team, has been indicted on 24 federal charges, Acting United States Attorney Julie A. Beck announced on March 20. Weiss, 42, faces 14 counts of unauthorized access to computers and 10 counts of aggravated identity theft.
According to the indictment, Weiss unlawfully hacked into student-athlete databases maintained by Keffer Development Services, LLC, a third-party vendor, from 2015 to January 2023. These databases, belonging to more than 100 colleges and universities, contained the personally identifiable information and medical data of over 150,000 athletes.
Related Article: Navigating Student Data Privacy in Higher Education
Using the stolen data along with information gathered through internet research, Weiss allegedly accessed the social media, email, and cloud storage accounts of more than 2,000 student-athletes. He was also accused of obtaining access to the accounts of over 1,300 additional students and alumni from universities nationwide.
The indictment further alleges that Weiss downloaded personal and intimate photographs and videos from these accounts, which were intended solely for private use between intimate partners.
“Thousands of candid, intimate photographs and videos have been seized from the defendant’s electronic devices and from his cloud storage accounts,” according to a court filing. “Many show victims naked. Some show victims engaged in explicit sexual acts.”
Weiss faces a maximum sentence of five years for each count of unauthorized computer access and an additional two years on each count of aggravated identity theft. The aggravated identity theft charges carry a mandatory two-year minimum sentence to be served consecutively with any other penalty imposed.
2 Victims Sue Weiss, the University of Michigan and Keffer Development
Following the announcement of the indictment, two alleged victims of Weiss filed a civil lawsuit against him. The plaintiffs, two former University of Michigan female athletes, claim that Weiss hacked their accounts and unlawfully downloaded their personal photos and videos. One athlete, a former member of the university’s women’s gymnastics team, attended between 2017 and 2018. The other, a member of the women’s soccer team, attended from 2017 to 2023, reports The Detroit News.
The lawsuit names the University of Michigan and its Board of Regents as co-defendants, alleging the university’s “recklessness and negligence” enabled Weiss’ actions. It also accuses the university of deliberate indifference to protecting the privacy of female athletes and that it elevated their risk of harassment.
Keffer Development Services, LLC, the vendor responsible for the athlete database, is also named in the suit, with allegations of “misconduct, negligence, and recklessness.”
Related Article: PowerSchool Data Breach: Report Finds Company Failed to Take Basic Cybersecurity Precautions
The University of Michigan responded to inquiries from ABC News with a statement from Kay Jarvis, director of public affairs, saying they have not been served with the complaint and cannot comment on pending litigation. Keffer Development Services has not provided a statement in response to the lawsuit.
Weiss’ employment with the University of Michigan ended in January 2023. Athletic Director Warde Manuel stated the termination was the result of a review conducted in accordance with University policies.
Weiss began his tenure at Michigan as a quarterbacks coach in 2021, before being promoted to co-offensive coordinator the following year. Before joining Michigan, he served with the NFL’s Baltimore Ravens as a coach in various capacities from 2009 to 2020.
