Univ. Of Michigan student-athlete files major class action lawsuit against school and former assistant football coach for image-based sexual abuse through breach of thousands of female athletes’ private data
Yesterday, Clarkson Law Firm, a leading national public interest firm, filed a class action lawsuit in the U.S. Federal District Court for the Eastern District of Michigan on behalf of a University of Michigan female student-athlete against former University of Michigan assistant football coach, Matthew Weiss, The University of Michigan and its Regents, and the school’s data system vendor, Keffer Development Services, following a major data breach that jeopardized the privacy and personal safety of thousands of students.
The suit alleges that Weiss abused his position as an assistant football coach and his access to university information systems, which contained highly sensitive student data, to hack into the personal accounts of primarily female athletes across the country. He then stole their intimate photos and private conversations off their devices and accounts for his own perverse use.
Due to poor cybersecurity and oversight practices from the university, Weiss was able to use his advanced access to students’ data to download personally identifiable information and medical data of more than 150,000 athletes. He then used that data to compromise passwords and hack into social media, email, or cloud storage accounts of more than 2,000 University of Michigan students and 1,300 additional students and alumni from universities and colleges across the country who also use Keffer’s databases.
“Students and alumni entrusted the University of Michigan with their most private information—only to have that trust utterly betrayed,” said Timothy Giordano, partner at Clarkson Law Firm. “The university’s reckless negligence in supervising employees and securing its student data systems directly enabled Weiss to commit image-based sexual abuse against thousands of students. This isn’t just a major failure by the university — it’s an unforgivable dereliction of duty. And yet, instead of taking responsibility, the university has done nothing to protect victims, remedy the harm, or ensure this never happens again.”
The plaintiff representing the class in this class action lawsuit was impacted by Weiss’ data breach. She is a current junior at the University of Michigan and a student-athlete who is shocked that her private information was able to be accessed by Weiss for his own illicit use. She now feels completely betrayed and violated as she trusted the university with her personal data and was let down by the institution she entrusted to protect her. Even though the Department of Justice has indicted Matthew Weiss on two dozen federal charges for hacking private data, hundreds of thousands of students’ private data, including this plaintiff’s, is still being held by the University of Michigan and Keffer, and thus could still be in jeopardy of abuse by bad actors.
“In the digital era, more of our lives – and our private information – has moved online, where the protections that we take for granted in our physical world do not exist or are not enforced,” said Ryan Clarkson, managing partner of Clarkson. “We must deter, prosecute, and hold accountable image-based sexual abuse with the same level of seriousness as we do physical sexual abuse. Not only Weiss but also Keffer Development Services and the University of Michigan, who must answer for how they allowed this massive breach of trust to occur, endangering thousands of students’ lives.”
The University of Michigan has established an alarming pattern of failing its athletes and students by improperly supervising its employees. Many of the students impacted by Weiss’ unlawful and immoral breach had their sensitive, private data leaked to the outside world. The loss of this privacy without their knowledge or consent cannot be undone and the trust they had in their institutions has been compromised.
“Matthew Weiss’ extensive data downloads of personal student information should have raised immediate red flags for supervisors, had even basic monitoring protocols been in place,” said Bryan Thompson, Counsel at Clarkson Law Firm. “Instead, the University of Michigan failed its duty and essentially allowed Weiss to engage in predatory behavior against its students. This incident raises serious questions about student safety and the security of the university’s data systems for which students and alumni deserve answers.”
Plaintiffs are seeking changes in the university’s safety, cybersecurity, and notification processes, as well as monetary relief, and are calling on Matthew Weiss, the University of Michigan and its regents, and Keffer Development Services, to answer for their misconduct.
About Clarkson
Clarkson, a public interest law firm founded in 2014, is made up of experienced trial lawyers, paralegals, and litigation professionals. We believe the law is an integral part of society’s checks and balances, empowering everyday citizens to create change. Justice means more to us than just recovering monetary damages. Our clients are an essential part of establishing precedents and policies that help protect countless others.
