A former University of Michigan co-offensive coordinator is facing charges for unauthorized access to computers and identity theft after he accessed private data for more than 3,000 student-athletes across the country. Two victims, in particular, are suing the former coach.
Matthew Weiss allegedly hacked student-athlete databases, email, cloud storage and social media from 2015 to 2023. He was fired by the university in 2023 for "computer crimes." The plaintiffs in his case are two former Wolverine student-athletes who competed in gymnastics and soccer between 2017 and 2023.
According to Click On Detroit, all of the databases Weiss accessed were managed by Keffer Development Services. He compromised “the passwords of accounts with elevated levels of access, such as the accounts of trainers or athletic directors.”
Weiss allegedly learned how to crack the encryption on the passwords through internet research. He would then stalk student-athletes online to learn their hometowns, nicknames and pet names that could be used to impersonate them. In some cases, he would follow the student-athlete’s online activity for months or even years.
His identity theft and unauthorized data access went beyond student-athletes as well. Weiss also accessed the email and social media accounts of alumni and staff at the University of Michigan and beyond. He reset the passwords of at least 40 email accounts of University of Michigan alumni, honing in on the vulnerabilities of the university’s account authentication process.
According to Click On Detroit, “He allegedly researched and targeted the women based on their school affiliation, athletic history and physical characteristics,” going so far as to obtain intimate videos and photos of the athletes. He “kept notes on those whose photographs and videos he viewed, including notes commenting on their bodies and sexual preferences.”
The lawsuit also names the University of Michigan and the Regents of the University of Michigan as defendants, as the plaintiffs argue that Weiss’s breach of the secure information is the result of UM’s “recklessness and negligence.”
