A former Cal State San Bernardino volleyball player is the latest female athlete to sue ex-University of Michigan offensive coach Matthew Weiss for allegedly hacking into her intimate digital photos as part of a nationwide breach.
The federal lawsuit, filed Thursday, April 24, by “Jane Doe,” who lives in Huntington Beach, alleges Weiss accessed her personal health information through an athletic training database used by the universities. That information was then used to hack into her personal photos and social media.
Weiss was federally indicted in March on 24 counts of identity theft and computer hacking for allegedly accessing the personal files — containing sexually explicit photos — of thousands of student-athletes nationwide from 2015 to 2023. Weiss, who was with the Baltimore Ravens when the hacking allegedly began, has pleaded not guilty.
“This scheme appears to be the largest cyber sexual assault of student athletes in U.S. history,” the suit states.
According to published reports, more than 17 women have filed lawsuits against Weiss. The latest “Jane Doe” lawsuit seeks at least $5 million in damages and was filed as a class action with room for more victims.
The suit accuses Weiss of gaining access to student files from more than 100 colleges and universities throughout the country that contracted with a database vendor that kept track of student-athletes’ health information.
Weiss allegedly used his access to the database to obtain passwords and other details, which he then used to gain entry to the social media, email and cloud storage of his victims, the suit says.
Among the items downloaded were thousands of intimate and sexually explicit photos and videos that federal authorities later found in his possession, according to the suit and published reports.
The suit also names as defendants Cal State San Bernardino and the database provider, Keffer Development Services, for not providing the necessary safeguards to prevent the breach.
“No institution with reasonable data security would allow such a breach over an eight-year period,” the suit said.
Keffer developed a computer system that tracks student information for athletic trainers at schools across the nation. The system stores student information treatment histories, diagnoses, injuries, photos and personal details: height and weight, mental health information, and demographic information.
“Keffer failed to implement basic, industry standard systems to protect students’ — including Jane Doe 1’s — personal identifying information and protected health information,” the suit said.
On March 26, Jane Doe was alerted by the U.S. Department of Justice Victim Notification System that her information was found in Weiss’ possession.
The suit said Jane Doe felt “violated, deeply disturbed, humiliated, embarrassed, and extremely emotionally distressed.”
“This cyber sexual assault invaded plaintiff’s privacy and has devastated her personally and emotionally, as her highly sensitive private information was stolen by an alleged predator under circumstances that were preventable by university defendants and defendant Keffer,” the suit said.
Keffer officials declined comment. Cal State San Bernardino did not respond to a request for comment.