College Football Coach Indicted for Stealing Private Data of 150K Athletes

A former college football coach at the University of Michigan has been charged for hacking into student athlete databases at over 100 colleges and universities.

On Thursday, the Justice Department charged 42-year-old Matthew Weiss, a former co-offensive coordinator, for computer-hacking related crimes that involved downloading data about more than 150,000 student athletes. 

Allegedly, Weiss then used the stolen data to help him break into the social media, email, and cloud storage accounts belonging to over 2,000 athletes. “Weiss primarily targeted female college athletes,” reads the 15-page indictment. “He researched and targeted these women based on their school affiliation, athletic history, and physical characteristics. His goal was to obtain private photographs and videos never intended to be shared beyond intimate partners.”

Federal investigators say Weiss conducted the hacking activities from 2015 to January 2023, when he was put on leave from the football team as campus police began to investigate the suspected computing-hacking crimes. 

Weiss conducted the hacks by first targeting a third-party vendor, Keffer Development Services. It operates the Athletic Trainer System, which stores medical information on student athletes. “Weiss obtained access to these databases through compromising the passwords of accounts with elevated levels of access, such as the accounts of trainers and athletic directors,” the indictment says. 

He was also able to download the passwords that the athletes themselves used to access the Athletic Trainer System. The downloaded passwords were encrypted but Weiss decrypted them by researching how to do so on the internet, the indictment says. 

“Using the combined information that he obtained from the student athlete databases and his internet research, Weiss was able to obtain access to the social media, email, and/or cloud storage accounts of more than 2,000 targeted athletes by guessing or resetting their passwords,” the court document adds. 

Allegedly, Weiss also went beyond student athletes and broke into the online accounts for 1,300 other students and alumni. “In at least several instances, Weiss exploited vulnerabilities in universities account authentication processes to gain access to the accounts of students or alumni,” the indictment says.

Weiss faces 14 counts of unauthorized access to computers and 10 counts of aggravated identity theft, which carries a maximum penalty of 90 years in prison if he’s convicted of all charges. 

Keffer Development Services didn’t immediately respond to a request for comment.

About Michael Kan

Senior Reporter

I’ve been working as a journalist for over 15 years—I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017.

Read Michael’s full bio

Read the latest from Michael Kan