Class Action Lawsuit Filed Against University of Michigan, Regents, and Former Football Coach Over Massive Student Privacy Breach

Detroit, Michigan – Eleven former and current student-athletes have filed a sweeping federal class action lawsuit in the U.S. District Court for the Eastern District of Michigan, alleging that the University of Michigan, its Regents, Keffer Development Services, LLC, and former football co-offensive coordinator Matthew Weiss were responsible for a massive data breach that exposed highly sensitive personal and intimate data of over 3,300 individuals.

Filed by Jane Does 1 through 11, the lawsuit alleges that from approximately 2015 to 2023, Weiss unlawfully accessed, downloaded, and used private photographs, videos, and data belonging to student-athletes through University and third-party systems. The complaint details allegations that Weiss exploited weak cybersecurity practices at the University and Keffer Development Services, which maintained databases with sensitive student-athlete information.

According to the lawsuit, Weiss allegedly used his position and University-issued credentials to gain unauthorized access to confidential data, including medical records, passwords, and personal cloud accounts. The Department of Justice has already begun notifying affected individuals, including two of the named plaintiffs, according to the lawsuit.

“This was not a random data breach—it was targeted, deliberate, and preventable,” said attorney Lisa Esser of Sommers Schwartz, P.C., one of the firms representing the plaintiffs. “These student-athletes placed their trust in the University and its partners to safeguard their most private information. That trust was betrayed on multiple levels.”

The complaint accuses the University and its Regents of failing to supervise Weiss, ignoring red flags, and failing to implement adequate cybersecurity measures. Keffer Development Services is also alleged to have failed to secure athlete data it collected on behalf of over 100 colleges and universities nationwide.

Among the legal claims are violations of the Stored Communications Act, the Computer Fraud and Abuse Act, Title IX, and constitutional violations under the Fourth and Fourteenth Amendments. Plaintiffs are seeking damages exceeding $50 million and class certification on behalf of thousands of affected student-athletes.

“Matthew Weiss acted with shocking disregard for the privacy and dignity of these women,” said Megan Bonanni of Pitt McGehee Palmer Bonanni & Rivers, co-counsel on the case. “But equally disturbing is the institutional failure that enabled this to happen and left students vulnerable for years.”

This lawsuit is the latest in a series of privacy-related actions filed against the University of Michigan, raising broader concerns about the school’s internal data practices and compliance with federal protections for students.

The plaintiffs are represented by Sommers Schwartz, P.C. and Pitt McGehee Palmer Bonanni & Rivers, P.C., and encourage others who believe they were affected to come forward by reaching out to Sommers Schwartz for a free, confidential, consultation by visiting https://www.sommerspc.com/class-action-commercial-litigation/investigations-cases/matt-weiss-university-student-athlete-hack/.

CASE INFORMATION
JANE DOE 1-11 vs. THE REGENTS OF THE UNIVERSITY OF MICHIGAN; the UNIVERSITY OF MICHIGAN; KEFFER DEVELOPMENT SERVICES, LLC, and MATTHEW WEISS
U.S. District Court, Eastern District of Michigan
Case: No. 2:25-cv-10946-JJCG-APP