Women fight back as ex-U of M coach is accused of stealing intimate images of student athletes

Around 150,000 student athletes from over 100 colleges had their personal data breached by former University of Michigan assistant football coach Matt Weiss, who hacked their accounts to download thousands of their private intimate photos, according to federal investigators. Now more than 50 women are suing Weiss and the institutions they say failed them.

One of the Jane Does who joined a class action suit against Weiss said the news of the data breach feels like deja vu, saying that she is a survivor of disgraced former Michigan State University physician Larry Nassar who is effectively serving three life sentences for possession of child pornography and sexually assaulting women and girls under the guise of medical treatment.

Another man with power over student athletes and influence in a university was able to exploit their access to students and again, a university “allowed it to happen and said nothing,” the woman said invoking MSU’s highly criticized response to Nassar’s abuse.

“It’s hard to describe the heartbreak of realizing that another institution we trusted has failed to protect us. After everything we went through with Nassar—and all the promises of change that followed—you want to believe that things will be different. That those in power will finally put athlete safety, privacy, and dignity first,” the woman told Michigan Advance. “Accountability should mean more than empty words—it has to involve meaningful, sustained action to prevent harm and rebuild trust. Right now, that still feels a long way off.”

‘It’s not over’: Survivors of Nassar’s abuse say the fight for justice is far from finished

The March indictment states investigators found that from 2015 until 2023, Weiss accessed a database used by athletic trainers at more than 100 colleges and universities and maintained by a third-party vendor, Keffer Development Services in Pennsylvania, to access student and alumni social media and cloud storage accounts in order to download private intimate images.

The allegations in the indictment occurred before and during his tenure at Michigan, where he was employed from February 2021 to January 2023. Before working at the university, he spent more than a decade with the Baltimore Ravens. Weiss was fired in January 2023 shortly after university police opened an investigation into reported computer crimes on the school’s Ann Arbor campus.

Weiss’ time at the university was limited, Kay Jarvis, Michigan director of public affairs, said in a statement Monday, adding the university responded quickly to reports of criminal activity.

The indictment said Weiss would research each targeted athlete for months, even years in some instances, looking for more and more photos and videos, keeping notes on each individual’s body and sexual preference.

Weiss was able to get into 3,300 individuals’ emails, social media and cloud storage accounts, the indictment said.

Weiss, who has pled not guilty, was charged March 20 with 24 counts of computer-related crimes. He could not be reached for comment.

News that thousands of students may have had their private images stolen has sent many former and current athletes into a panic. Many have used aliases to protect their identities in the civil suits except for McKenzie Johnson, who told Michigan Advance during a news conference Monday that she hopes by putting a name and a face to this violation, it will help shine a light on it.

Johnson played softball for Grambling State University in Louisiana from 2015 to 2019. She said she’s very concerned what images Weiss may have allegedly gotten his hands on as she navigates the workforce as a young professional.

“I don’t understand how something like this could happen. It’s my goal from this lawsuit to learn more about what has occurred. I can personally say that I’m very anxious about what will come from this and what personal information that he has stolen from me,” Johnson said.

The lawsuits name the university, its regents and Keffer Development Services as defendants.

What Weiss is accused of is nothing short of sexual violence, Megan Bonanni, the attorney representing the woman identifying herself as a Nassar survivor and 10 other women in a civil suit, told Michigan Advance.

“This is a digital sexual assault,” Bonnani said. “…And just like a physical sexual assault, the amount of trauma, the amount of complete uncertainty… that’s what we’re seeing from our clients. They do not feel safe, and this feeling that they are unsafe is going to continue into the future.” 

None of the women she is representing, mostly former University of Michigan athletes, have received notification from university officials that their data may have been compromised, Bonnani said. The university could have been an ally to these athletes and supported them, Bonnani added.

Jarvis said in the statement: “Upon learning of potentially concerning activity in its systems, the University promptly placed Mr. Weiss on leave, forwarded this matter to law enforcement authorities and moved forward with Mr. Weiss’ termination on January 21, 2023.”

The woman identifying as a Nassar survivor said the university failed to protect athletes, secure their data and alert students and athletes to change their passwords.

“Matt Weiss should never have had the opportunity to violate student privacy, and the University had a responsibility to safeguard our information and be transparent when that trust was broken. Instead, they stayed silent. That’s not just negligence—it’s betrayal,” the woman told Michigan Advance. 

The images and media belonged to the athletes and they had every right to privacy and to victim blame would be to miss the point, said attorney Lisa Esser-Weidenfeller, who is collaborating with Bonnani.

“None of these women, none of them, did anything wrong,” Esser-Weidenfeller said. “I just want to make that super clear. Sometimes you read these stories and you start to read the comments. None of these women, none of these athletes, did anything wrong to contribute to this, right? I mean, it’s like being invaded in the privacy of your own home.”

Bonnani said none of the athletes she’s representing know specifically what images or information were compromised and whose hands they may have been exchanged to.

The civil lawsuits filed in the last month have depicted how the data breach has disrupted student athletes’ lives. One plaintiff, a junior competing for the university referred to as  “Jane Roe,” said she was shocked and humiliated to learn of the data breach on the news and not from the school.

“Plaintiff seeks to hold the Defendants accountable for their actions and inactions that have caused immense fear, anxiety, humiliation, loss of dignity, and loss of privacy that cannot simply be undone,’’ the lawsuit said. 

It was not the first time a University of Michigan staffer was accused of using their position to exploit students. 

More than 1,000 individuals have come forward in recent years with accusations of sexual assault by the late Robert Anderson, a physician who practiced at the university for nearly four decades. The university settled with survivors for $490 million in 2022, but like in the case of Nassar at MSU, survivors have railed for change at university governance meetings and protested for years begging the school to create safeguards for athletes.

 The Army of Survivors, an advocacy group working to protect athletes from sexual violence, said in a statement, Michigan has offered no meaningful public acknowledgment of the harm athletes are facing nor commitment to reviewing accountability structures. 

 “These victims are not footnotes to a scandal, they are human beings whose trust was betrayed, whose dignity was stolen, and who deserve far more than a university’s carefully worded deflections,’’ the group said in the statement. “They deserve answers. They deserve justice. And they deserve institutions willing to stand up and say: ‘We failed you. And we will do better.’”

Real justice, the woman said, would have meant survivors were listened to the first time. It also means reclaiming power, she added.

“For me, justice in this case means more than just punishing one person. It means exposing the full scope of the failure and holding the institution accountable,” the woman said.