The Matt Weiss lawsuits are a set of civil cases filed by former college athletes against the ex-University of Michigan football coach, the university, several of its leaders, and the athletic-database vendor Keffer Development Services, running alongside a 24-count federal criminal indictment charging Weiss with hacking thousands of student-athletes’ accounts to steal intimate photos and videos. The civil suits seek damages for victims whose personal data and images were allegedly compromised; the criminal case, still in pretrial motions, is set for trial on September 22, 2026.1Detroit News. Weiss UM Sex Case: High Stakes as Judge Weighs Tossing Evidence
What Weiss Is Accused of Doing
Federal prosecutors allege that between roughly 2015 and January 2023, Weiss ran a years-long hacking scheme targeting college athletes across the country. The alleged pipeline started with a third-party database run by Keffer Development Services, a Pennsylvania company whose Athletic Trainer System software stores medical records for about 108 university athletic departments. Prosecutors say Weiss used breached credentials, open-source research, and compromised accounts of athletic directors and trainers to pull personally identifiable information and medical data on more than 150,000 athletes at over 100 schools.2U.S. Judicial Panel on Multidistrict Litigation. MDL-3159 Transfer Order
From that base, according to the indictment, he cracked or reset passwords to break into the social media, email, and cloud storage accounts of more than 2,000 athletes and over 1,300 additional students and alumni, hunting for intimate photos and videos the victims had shared only with partners. Investigators seized thousands of such images from his devices and cloud accounts and say he kept notes commenting on victims’ bodies and sexual preferences.3U.S. Department of Justice. Former University of Michigan Football Quarterbacks Coach and Co-Offensive Coordinator Indicted4The New York Times / The Athletic. Matt Weiss Michigan Indictment Charges
Affected schools named in reporting and litigation include Michigan, Kentucky, Towson, Radford, Cal State San Bernardino, Malone, and Westmont, among others.5NBC News. Former College Athletes’ Coach Hacked Private Photos The scheme surfaced in January 2023, when a Michigan employee reported fraudulent activity on university email accounts. Weiss was placed on leave, refused to cooperate with the internal investigation, and was fired on January 7, 2023.6Scripps News. FBI Joins Probe Into Former Michigan Football Coach Matt Weiss
The Federal Criminal Charges
On March 20, 2025, a federal grand jury in the Eastern District of Michigan returned a 24-count indictment. The counts fall into two groups:
- 14 counts of unauthorized access to computers, each carrying a maximum five-year sentence.
- 10 counts of aggravated identity theft, each carrying a mandatory two-year sentence that must run consecutively to any underlying offense.
A conviction on all counts would expose Weiss to decades in federal prison.3U.S. Department of Justice. Former University of Michigan Football Quarterbacks Coach and Co-Offensive Coordinator Indicted Weiss was arraigned on March 24, 2025, pleaded not guilty, and was released on a $10,000 unsecured bond.7ABC News. Lawsuit Filed Against Former Michigan Coach in Alleged Hacking Case
Where the Criminal Case Stands
Weiss’s defense team, led by David Benowitz, has fought hard on two fronts: the shape of the charges and the admissibility of the evidence.
On the charges, the defense moved to dismiss the ten aggravated identity theft counts in October 2025, arguing that using stolen login credentials is closer to using a stolen key than to impersonating someone. Benowitz called it an attempt to “bootstrap computer trespass into aggravated identity theft,” turning a misdemeanor-level case into one carrying a potential 20-year sentence.8NBC News. Former Michigan Coach Matthew Weiss Fights Identity Theft Charges Judge Nancy G. Edmunds denied the motion on December 22, 2025. She wrote that although the argument had “some intuitive appeal,” Weiss “accessed the accounts without permission by misrepresenting ‘who’ was logging in, not just ‘how or when’ he was doing it,” and found the prosecution’s use of the statute “proper and aligned with previous judges’ readings of the law.”9Detroit News. Federal Judge Denies Matt Weiss Attempt to Get Identity Theft Charges Tossed A broader omnibus motion to dismiss counts on duplicity, multiplicity, and venue grounds was denied on January 5, 2026.10U.S. Department of Justice. US v. Matthew Weiss
On the evidence, the defense has filed two suppression motions. One attacks the search warrants obtained by University of Michigan police as “patently illegal.” The other targets iCloud material the defense says was seized in “flagrant disregard of the warrant’s temporal scope,” alleging Apple produced 2020 data when investigators had asked only for 2022–2023 records.11CourtListener. United States v. Weiss, 2:25-cr-20165 At a June 2026 hearing, Benowitz argued Weiss had a reasonable expectation of privacy on his university-issued devices due to Michigan’s “permissive policy.” Prosecutor Timothy Wyse countered that the FBI investigation ran independently of the campus warrant and that the devices displayed banners warning that misused activity could be searched. Judge David M. Lawson, who took over after the case was reassigned in late 2025, said he would take up to 30 days to rule.1Detroit News. Weiss UM Sex Case: High Stakes as Judge Weighs Tossing Evidence
No plea deal has been reported. Trial is set for September 22, 2026.1Detroit News. Weiss UM Sex Case: High Stakes as Judge Weighs Tossing Evidence
The Civil Lawsuits
Victims have filed a series of civil suits in the Eastern District of Michigan seeking damages from Weiss and the institutions they say failed to stop him. The claims include violations of the Computer Fraud and Abuse Act, the Stored Communications Act, Title IX, and negligence, plus state-law claims such as assault, intentional infliction of emotional distress, and violations of the Michigan Identity Theft Protection Act.12ClassAction.org. Doe One et al. v. Weiss et al.13Buckfire Law. Buckfire Law Files Mass Lawsuit Against Matt Weiss and University of Michigan
The first suit landed on March 21, 2025, one day after the indictment. Stinar Gould Grieco & Hensley filed a proposed class action for two anonymous former Michigan athletes, a gymnast and a soccer player, against Weiss, the University of Michigan, its Board of Regents, and Keffer Development Services, proposing a class of more than 1,000 additional victims.12ClassAction.org. Doe One et al. v. Weiss et al. A second class action followed on March 27, 2025, from the Clarkson Law Firm.14Detroit News. Student Athlete Files Class Action Lawsuit Against Ex-UM Coach Weiss On April 10, 2025, Buckfire & Buckfire filed what it called a “mass action” rather than a class action, arguing that each victim’s damages were too distinct for class treatment.13Buckfire Law. Buckfire Law Files Mass Lawsuit Against Matt Weiss and University of Michigan
Harbaugh, Manuel, and Ono Added
In June 2025, plaintiffs amended their complaint to add former head coach Jim Harbaugh, athletic director Warde Manuel, and former university president Santa Ono as defendants. The lawsuit alleges that Harbaugh and other university officials knew between December 21 and 23, 2022, that Weiss had accessed the private information of female student-athletes, and let him continue coaching through Michigan’s Fiesta Bowl against TCU on December 31, 2022. Plaintiffs’ counsel Parker Stinar said naming Harbaugh and Manuel reflected the belief that “leadership at the highest levels either knew of these threats or deliberately ignored them.”15Wolverines Wire / USA Today. Michigan Football Matt Weiss Scandal Lawsuit: Jim Harbaugh, Warde Manuel Harbaugh has denied prior knowledge, saying he did not learn of the allegations until after the Fiesta Bowl and describing his reaction to the indictment as “Shocked. Completely shocked. Disturbed.”16The New York Times / The Athletic. Jim Harbaugh Michigan Matt Weiss Lawsuit
Keffer Development Services and the MDL
Keffer Development Services is a defendant in nearly all of the civil suits. Plaintiffs allege the company failed to secure the Athletic Trainer System database, giving Weiss the foothold he needed to reach victims at more than 100 schools. With cases piling up across federal courts, Keffer sought consolidation. In July 2025, the Judicial Panel on Multidistrict Litigation centralized 12 pending actions into MDL No. 3159, In re: Keffer Development Services, LLC, Data Security Breach Litigation, assigned to Judge Mark A. Goldsmith in the Eastern District of Michigan. Eleven of the twelve seek to represent a nationwide class of individuals whose data or images were compromised.2U.S. Judicial Panel on Multidistrict Litigation. MDL-3159 Transfer Order
The Michigan-focused suits are separate from the Keffer MDL. Motions to consolidate those cases were filed in spring 2025 but had not been resolved in the available record.17CourtListener. Doe 1 v. Weiss, 2:25-cv-10806
What Victims Have Been Told
Communication with victims has itself become a source of legal pressure. Michigan spokesperson Kay Jarvis said the university placed Weiss on leave upon learning of “potentially concerning activity,” referred the matter to law enforcement, terminated his employment, limited certain database access, and conducted an “IT security review.”18Michigan Advance. Women Fight Back as Ex-U of M Coach Is Accused of Stealing Intimate Images of Student Athletes
Attorney Parker Stinar has called the incident “the largest data breach in the history of the United States by an academic institution” and accused Michigan of not notifying student-athletes at any point between the 2022 discovery of the breach and the March 2025 indictment.19ClickOnDetroit. Attorney Accuses University of Michigan of Repeated Failures After Matt Weiss Data Breach Attorney Megan Bonanni said as of April 2025 that none of the women she represented had received notice from the university; many learned about the breach through news coverage.18Michigan Advance. Women Fight Back as Ex-U of M Coach Is Accused of Stealing Intimate Images of Student Athletes
Victims identified during the FBI investigation received a Victim Identification Number and were pointed to the FBI’s Victim Notification Service. Recipients told reporters the portal offered little detail about which of their accounts had been compromised or what Weiss may have accessed.20The New York Times / The Athletic. Michigan Football Coach Hacking Matt Weiss Victims Some universities outside Michigan, including Kentucky and Radford, told reporters they had received no notice from the Department of Justice about the breach at all.5NBC News. Former College Athletes’ Coach Hacked Private Photos Plaintiffs’ attorneys have said the civil suits are aimed in part at forcing that disclosure through discovery.