Attorney says data hack case by ex-U-M coach of female athletes is just 'tip of the iceberg'

FOX 2 - A hacked data breach lawsuit press conference against a former University of Michigan football coach, involving more than 40 women and expanding, was held Monday in an investigation the attorney compared to like peeling back layers of a rotten onion.

Big picture view:

Matthew Weiss is facing a federal indictment for allegedly accessing potentially thousands of female athletes' personal information, private photos, social media, email, and cloud storage accounts, as early as 2015, before he worked at U of M. Authorities said he continued to do so until 2023.

"Like I said, this is the tip of the iceberg," said Attorney Jon Marko. "I think as we peel back the layers of this rotten onion that the University of Michigan has created, that we're going to discover that, that there's going to be different entanglements out there, that there's going to be additional, women and individuals."

Weiss is facing a lawsuit for allegedly hacking the accounts of numerous female athletes and accessing private photos. He was fired in 2023 after failing to cooperate with the university's investigation into the case, was recently charged with 24 federal counts, including unauthorized access to computers and aggravated identity theft.

There are more than 40 women involved in the lawsuit filed by Marko Law, also named the University of Michigan, the Regents of the University of Michigan, and Keffer Development Services, LLC.

Weiss allegedly obtained access without authorization to student athlete databases of more than a hundred colleges and universities.  According to court documents Matt Weiss kept notes on individuals whose photos and videos that he looked at — comments on their bodies and sexual preferences.

Marko said the lawsuit is being amended to add more individuals.

"This affected not only our athletes here in Michigan and not only the Wolverines, but this affected women all over the country who've been exposed and had their data breached," he said. "When (the university) found out about it, they've done nothing in the past three years to try to notify these women."

Dig deeper:

McKenzie Johnson, one of the former female athletes impacted, is being represented by Marko, and shared her story publicly as part of the lawsuit.

"Miss Johnson and others had to be notified by the Department of Justice that their data have been exposed and that there was a breach and that their most private, sensitive, intimate videos, data, and photos have been taken by a strange man and are now apparently on servers at the University of Michigan," Marko said.

Johnson said she now works professionally with a Fortune 500 company. From 2015 to 2019, she played softball at Grambling State University.

She said she recently learned that her private information was stolen by Weiss and that her personal email and social media accounts were hacked into, in 2022.

"I don't know yet what information was stolen, so I have a great deal of fear and uncertainty about this situation, honestly," she said. "The University of Michigan has never notified me about this privacy violation, so I had no opportunity to personally protect myself."

Marko said for the past three years there was no notification of the data breach for the women.

Related:

• Hacking investigation: Ex-Michigan, Ravens coach had thousands of intimate images
• Lawsuit filed against University of Michigan, Matt Weiss after allegations he hacked female athletes' accounts

"That would have been a nice time to tell these thousands, tens of thousands, potentially of people that their data could have been exposed and were sitting on servers and out there," he said.

Marko said that just because there is a criminal court case underway, it doesn't mean that the university doesn't still have civily responsibility.

"First of all, we have a lot of beef with U of M, so this was an employee of U of M," he said. "The university's responsible. They have an obligation to protect their students and others.

"A police investigation doesn't relieve the university for years of failing to protect the individuals who are subject to the data breach. So, the FBI has to do what the FBI has to do. The university has to do with the university should do, and they failed to do it in this case."

Marko Law and Hurwitz Law filed a temporary restraining order to place the personal data of those impacted in a "secure, trusted, neutral third party."

"We know that they seized Matthew Weiss's electronic devices, including that data," said Marko. "And so we need, confirmation, in order that, this will be disgorged and secured outside of the university. It should not be in the university's hands."

The University of Michigan issued this statement:

"While the federal indictment asserts that Matt Weiss improperly accessed online accounts of unsuspecting individuals between approximately 2015 and January 2023, Weiss was employed by the University of Michigan for less than 2 years, from February, 2021 to January, 2023.  

"Count 23 of the indictment is specific to the University of Michigan and alleges that Weiss accessed protected UM computers without or in excess of authorization from December 21, 2022 to December 23, 2022.  

"Upon learning of potentially concerning activity in its systems, the University promptly placed Mr. Weiss on leave, forwarded this matter to law enforcement authorities and moved forward with Mr. Weiss' termination on January 21, 2023."

Crime and Public SafetyAnn ArborMichigan