ANN ARBOR, Mich. – Former Michigan Wolverines football assistant coach Matt Weiss, 42, is at the center of what attorney Parker Stinar of Stinar Gould Grieco & Hensley said: “This is, to my understanding, the largest data breach in the history of the United States by an academic institution.”
Beyond Weiss, Stinar said the University of Michigan betrayed roughly 150,000 individuals, including student-athletes, by failing to notify them about the breach for years.
“It wasn’t until March of 2025 that their student-athletes became aware of the magnitude of the data breach, the magnitude of confidential information that was accessed, and the magnitude of harms that they may have experienced,” Stinar said.
Stinar said the university first became aware of a cybersecurity concern in late 2022 when a student reported suspicious activity on her personal email account.
“That’s when the University was put on notice and began their investigation,” Stinar said.
However, despite launching an investigation and consulting with law enforcement, Stinar said the university “did not alert those affected,” including the original student who reported the breach, about the severity of the situation.
Weiss was placed on leave in 2023, yet Stinar said the university and its Regents never warned student-athletes about the breach until March 2025, when the indictment was made public.
“The university has yet to issue a public statement,” Stinar said. “And never once, never once between 2022 and the day of the indictment had the university notified their student-athletes that their information may have been compromised.”
According to court records, Weiss illegally accessed a vast database of athletes at more than 100 colleges and universities over the course of roughly eight years, from 2015 to January 2023.
Federal prosecutors said it impacted around 150,000 individuals, including roughly 3,300 University of Michigan student-athletes, Stinar said, who are now left in fear.
“They’re fearful that bank accounts could be open in their name; they’re fearful that intimate photos, videos, and conversations that they’ve had are being leaked,” Stinar said. “They feel betrayal and trauma from this university that they gave their blood, sweat, and tears to, which failed to protect them.”
Court records indicated the stolen information included dates of birth, addresses, maiden names, personal email accounts and passwords, medical records, private photos and videos, and other intimate information.
The indictment suggests that Weiss also used stolen credentials to access victims' social media accounts, potentially exposing intimate and highly sensitive personal information, specifically targeting women based on their school affiliation, athletic history, and physical characteristics.
Prosecutors said Weiss was keeping notes on the photos and videos he downloaded, commenting on their bodies and sexual preferences, and returning years later to search for new images.
For the former female athletes now seeking legal action, the university’s failure to notify them has only deepened their sense of betrayal, said Stinar.
“There’s tremendous fear and very little answers,” Stinar added.
Even now, Stinar said the University of Michigan had not contacted current student-athletes or alums about whether their accounts were hacked.
“The reality is the vast majority don’t even know what’s taking place or that their information was compromised,” Stinar said.
Beyond seeking justice for the victims, Stinar, who also represented victims Dr. Robert Anderson, the late physician who allegedly sexually abused more than 1,000 people during his time at the school, said the civil lawsuit aims to force accountability and institutional change at the University of Michigan.
“The biggest question that these young individuals have is, How did you fail me? Why did you fail me? Why didn’t you protect my extremely confidential information?” Stinar said.
The University of Michigan has not yet responded to multiple requests for further comment.
Director of Public Affairs, Kay Jarvis, said, “We have not been served with the complaint and cannot comment on pending litigation.”
--> Ex-Michigan football coach Matt Weiss charged in cybercrime operation targeting student-athletes
