Everything You Need to Know About the Michigan Hacking Scandal

Former Michigan assistant football coach Matt Weiss is at the center of a sex abuse hacking case that federal officials say targeted thousands of college athletes across the country.

In a federal indictment released last week, federal prosecutors claim Weiss hacked into medical systems to gain information about the female athletes, which helped him break into their social media, email, and cloud storage accounts to access intimate photos and videos.

Former and current Michigan athletes have also filed at least three class action lawsuits against him.

Weiss was fired by Michigan in January 2023 for “a report of computer access crimes” at its football facility. Before working as co-offensive coordinator under Jim Harbaugh in Ann Arbor, he was an assistant for John Harbaugh with the Baltimore Ravens.

Here’s everything you need to know about the situation.

What is he accused of?

Weiss is accused of hacking into accounts of thousands of female athletes to gain access to intimate private photos and videos stored on their devices and accounts.

Weiss is not accused of sharing any of the photos or videos he obtained, or by reaching out to the victims to try to blackmail or get money from them. This is an important legal distinction because many of the laws around hacking, extortion, or revenge porn involve sharing the information, threatening to share it, or trying to take money from victims.

In the federal indictment, Weiss is currently facing 24 counts for unauthorized access and aggravated identity theft violating state and federal laws, but that number could go up as more states or victims come forward. At least three class action suits have been filed by current and former Michigan athletes against Weiss, the university, the board of regents, and Keffer and make many of the same accusations as the federal indictment.

How did he do it?

The federal indictment says Weiss used the third-party company Keffer Development Services that keeps medical records of thousands of college athletes. He researched individuals online to guess passwords and security question information, sometimes of school employees like athletic trainers or athletic directors, which helped him download information and passwords of athletes, which he then un-encrypted.

The indictment says he got access to social media, email, or cloud storage accounts of more than 2,000 athletes “by guessing or resetting their passwords,” after which he “searched for and downloaded personal, intimate photographs and videos that were not publicly shared.”

Weiss returned to the same account months and even years after he first broke in to look for more photos and videos, the indictment says, and kept notes on the women “commenting on their bodies and their sexual preferences.”

How broad is the impact?

The federal indictment says he hacked into accounts of more than 3,300 people, including 2,000-plus athletes. But the indictment also says he downloaded personal information and medical data of more than 150,000 athletes. On top of the athletes he targeted, the indictment says Weiss also accessed accounts of more than 1,300 students or alumni from schools across the country, often by breaking through a school’s weak authentication process.

To give one example of Weiss’s scope, at least five athletes at the Division II Westmont College in Santa Barbara, California were targeted, ESPN reported Thursday. Weiss is from Connecticut, and has not attended school or coached in Southern California.

What are the legal consequences?

Weiss faces up to five years in prison and a $250,000 fine for each count of unauthorized access to computers and up to two years for each count of aggravated identity theft. Weiss pleaded not guilty to the criminal charges against him.

The class action plaintiffs are expecting more money. One of the complaints filed says the damages exceed $5 million and involve more than 100 victims, most of whom are not in Michigan.

Weiss is not the only one facing charges. The women involved, only identifying themselves as Jane Does, have been vocal about “a university that has the opportunity to prevent it from happening and doesn’t.” Michigan settled in 2022 for $490 million in a sex abuse case centered around a sports doctor who died in 2008 that paid out more than a thousand people.

“We’re seeing it again, where the university has failed to protect those that give their blood, sweat and tears to the school,” said Parker Stinar, an attorney in one of the class action suits.

Michigan says it has not been served with the suits and cannot comment.

How does the NFL tie into this?

The federal indictment says Weiss began his scheme in 2015, while he was an assistant for the Baltimore Ravens. Weiss was in Baltimore for most of the seven or eight-year stretch where he is accused of this behavior. He was hired by Michigan in 2021 as its quarterbacks coach.

Then, after Weiss was fired by Michigan for an investigation into “computer access crimes” in early 2023, he returned to the NFL, doing contract work for the Browns in 2023 and the Seahawks in 2024, Pro Football Talk reported. 

The league did not comment for either PFT story about his post-Michigan work as a contractor, and the league office did not immediately respond to a request for comment.