2 former UM athletes sue ex-Michigan coordinator, accuse him of stealing 'intimate' photos

Two female former student-athletes from the University of Michigan have filed a federal lawsuit against the university and its former assistant football coach, alleging their privacy was invaded when he hacked into personal accounts of thousands of college athletes to steal intimate photos and videos.

Matt Weiss, the former University of Michigan football program's co-offensive coordinator under coach Jim Harbaugh, was indicted Thursday on 24 counts, including 14 counts of unauthorized access to computers and 10 counts of aggravated identity theft. He was sued by the two women on Friday. Both actions were in federal court.

The federal indictment alleges Weiss gained illegal access to a database of student-athletes at more than 100 colleges and universities that was maintained by a third-party company. Weiss is accused of downloading personal information and medical data of more than 150,000 athletes and using that information to obtain access to the social media, email and cloud storage accounts of more than 3,000 athletes. He allegedly downloaded personal intimate digital photographs and videos "that were never intended to be shared beyond intimate partners," federal prosecutors said Thursday.

A UM spokesman refused to comment about the scandal Thursday and referred a reporter to the FBI office in Detroit. Kay Jarvis, director of public affairs, said Monday the university has not been served with the lawsuit and cannot comment on pending litigation.

The lawsuit alleges that the two women, one who was a gymnast in 2017 and 2018 and one who was a soccer player from 2017 to 2023, were among Weiss's thousands of victims. The University of Michigan and its Board of Regents failed to supervise and monitor Weiss, which led to women having their privacy invaded, according to the lawsuit.

Weiss allegedly hacked into a database maintained by Keffer Development Services, a Pennsylvania-based firm headed by CEO Rhett Keffer, where personally identifiable information and medical data of more than 150,000 student-athletes was stored, according to the lawsuit.

The attorney for the two women who filed the lawsuit, Parker Stinar, said the university has "once again failed in its duty to protect its students and student-athletes from the threat of a sexual predator."

"This negligence has compromised the confidentiality of personal, medical, and intimate information, leading to profound feelings of betrayal, trauma, and fear among former female student-athletes and others affected," Stinar said in an emailed statement. "It is troubling that a university that prides itself on being the 'Leaders and the Best' continuously falls short in safeguarding those who dedicate their hard work and passion to its athletic programs. We are committed to holding the University accountable for its actions and to ensuring that such failures do not happen again."

The government alleges Weiss hacked the databases by compromising the passwords of accounts belonging to trainers and athletic directors. He downloaded the passwords — which the lawsuit alleges were poorly encrypted — the students used to access Keffer's system, then allegedly used that and information he gained from Keffer to obtain access to their social media, email and cloud storage accounts by guessing or resetting their passwords.

"His ability to do so was aided by the University and the Regents, both of whom permitted him to have access and use of electronic credentials that were means of viewing and downloading personal, private, and intimate images of Plaintiffs and others similar to them," according to the lawsuit. "The recklessness and negligence and misconduct of the Regents, the University, and Keffer in these respects enabled Weiss to target female college athletes to obtain their private and sensitive information without authorization, including but not limited to Plaintiffs."

Keffer Development Services is also named in the lawsuit.

“I have no comment for the media,” Keffer told The Detroit News on Thursday. A woman who answered the phone at Keffer Development Services Monday said Keffer had no comment on the lawsuit.

Weiss allegedly kept notes on the people whose photos and videos he wanted, "commenting on thebodies and sexual preferences of Plaintiffs and their peers."

The case was filed more than two years after The Detroit News revealed an investigation involving Weiss and alleged computer crimes inside the football team's offices on campus. Weiss was fired in January 2023.

The case describes crimes that spanned parts of eight years and victimized athletes in Michigan, Maryland and Pennsylvania, and students at universities large — the University of Michigan — and small — including Westmont College, a private, Christian liberal arts college in California with about 1,300 undergrads.

The alleged criminal activity happened from 2015-23, and Weiss is accused of primarily targeting female college athletes, according to the indictment.

If convicted, he faces up to five years on each computer charge and two years on each identity theft charge.

“I have nothing but respect for the University of Michigan and the people who make it such a great place,” Weiss wrote on X shortly after he was fired. “I look forward to putting this matter behind me and returning my focus to the game that I love."

Weiss was hired by Harbaugh from the Baltimore Ravens to coach Michigan’s quarterbacks in February 2021 and was later promoted to co-offensive coordinator with current head coach Sherrone Moore. Weiss made a $600,000 base salary in 2021 and signed a three-year contract extension in early 2022 that bumped his pay to $850,000.

Weiss spent 12 seasons on the Ravens staff for head coach John Harbaugh, Jim Harbaugh’s older brother. Weiss was a graduate assistant at Stanford from 2005 to 2008, where he had previously worked for Jim Harbaugh

kberg@detroitnews.com