Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.

64 Filed 04/13/25 Page 1 of 52

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF MICHIGAN
SOUTHERN DIVISION

MCKENZIE JOHNSON, JANE DOE 1,

JANE DOE 2, JANE DOE 3,
JANE DOE 4, JANE DOE 5,
JANE DOE 6, JANE DOE 7,
JANE DOE 8, JANE DOE 9,
JANE DOE 10, JANE DOE 11,
JANE DOE 12, JANE DOE 13,
JANE DOE 14, JANE DOE 15,
JANE DOE 16, JANE DOE 17,
JANE DOE 18, JANE DOE 19,
JANE DOE 20, JANE DOE 21,
JANE DOE 22, JANE DOE 23,
JANE DOE 24, JANE DOE 25,
JANE DOE 26, JANE DOE 27,
JANE DOE 28, JANE DOE 29,
JANE DOE 30, JANE DOE 31,
JANE DOE 32, JANE DOE 33,
JANE DOE 34, JANE DOE 35,
JANE DOE 36, JANE DOE 37,
JANE DOE 38, JANE DOE 39,
JANE DOE 40, AND JANE DOE 41,
on behalf of themselves and others
similarly situated,

Plaintiffs, Case No. 25-10855

v. Hon. Mark A. Goldsmith

MATTHEW WEISS; the REGENTS

OF THE UNIVERSITY OF MICHIGAN;
the UNIVERSITY OF MICHIGAN;
KEFFER DEVELOPMENT SERVICES,
LLC,

Defendants.

1
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.65 Filed 04/13/25 Page 2 of 52

Jonathan R. Marko (P72450) Daniel B. Tukel (P34978)

MARKO LAW, PLLC BUTZEL LONG
Attorneys for Plaintiff Attorney for Defendant
220 W. Congress, 4th Floor 201 W. Big Beaver Road Suite 1200
Detroit, MI 48226 Troy, Michigan 48084
(313) 777-7529 (248) 258-1616
[email protected] [email protected]

Noah S. Hurwitz (P74063)

HURWITZ LAW PLLC
Attorneys for Plaintiff
340 Beakes St., Suite 125
Ann Arbor, MI 48104
(844) 487-9489
[email protected]

There is no other pending or resolved civil action arising out

of the transaction or occurrence alleged in this Complaint.

PLAINTIFFS’ FIRST AMENDED CLASS ACTION COMPLAINT

Pursuant to Fed. R. Civ. P. 15(a)(2), Plaintiffs MCKENZIE JOHNSON,

JANE DOE 1, JANE DOE 2. JANE DOE 3, JANE DOE 4, JANE DOE 5, JANE

DOE 6, JANE DOE 7, JANE DOE 8, JANE DOE 9, JANE DOE 10, JANE DOE

11, JANE DOE 12, JANE DOE 13, JANE DOE 14, JANE DOE 15, JANE DOE 16,

JANE DOE 17, JANE DOE 18, JANE DOE 19, JANE DOE 20, JANE DOE 21,

JANE DOE 22, JANE DOE 23, JANE DOE 24, JANE DOE 25, JANE DOE 26,

JANE DOE 27, JANE DOE 28, JANE DOE 29, JANE DOE 30, JANE DOE 31,

JANE DOE 32, JANE DOE 33, JANE DOE 34, JANE DOE 35, JANE DOE 36,

JANE DOE 37, JANE DOE 38, JANE DOE 39, JANE DOE 40, AND JANE DOE

41 (“Plaintiffs”), through their attorneys, MARKO LAW, PLLC and HURWITZ

2
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.66 Filed 04/13/25 Page 3 of 52

LAW PLLC, for their First Amended Class Action Complaint against MATTHEW

WEISS, the REGENTS OF THE UNIVERSITY OF MICHIGAN, the

UNIVERSITY OF MICHIGAN, and KEFFER DEVELOPMENT SERVICES,

LLC,state as follows:

INTRODUCTION

Student-athletes at the University of Michigan entrusted private and sensitive

information to the University with the expectation that they would be protected and

safeguarded from the potentially dangerous actions of athletic department

employees who interact daily with student-athletes and have influence upon

them. Only a massive failure of oversight would allow for one of the University’s

highest paid employees, an Offensive Coordinator of the Michigan football team, to

use his position of highest authority to terrorize the heart of the University Michigan

Athletic Department, its student-athletes. Worst yet, the University covered up its

actions, failing to notify University athletes and thousands of students nationally that

Coach Weiss had stolen their most private and sensitive information. The

University’s actions have thus prevented the victims from protecting themselves

after their stolen information was made publicly available.

As an example of the University’s incredible failure to protect students

nationally, Representative Plaintiff McKenzie Johnson was notified by the United

States Department of Justice that Coach Weiss stole her private information and then

3
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.67 Filed 04/13/25 Page 4 of 52

hacked into her email and social media accounts. Despite knowing in February 2023

that Coach Weiss was a vicious predator with possession of private and sensitive

documents, Ms. Johnson was never informed by the University that Weiss had stolen

her information, violating numerous civil and criminal laws. Accordingly, two years

have passed with Ms. Johnson having zero opportunity to safeguard her information

or prevent further crimes from being perpetrated against her. Ms. Johnson has no

affiliation with the University and it is unfathomable that the University would have

decided to sweep these crimes under the rug instead of coming clean with the truth

of what happened. Had the University done so in the case of Ms. Johnson, she could

have safeguarded her information and prevented further dissemination of the private

information.

Even now after years of investigation and countless inquiries, the University of

Michigan still refuses to acknowledge and communicate with victims of these

heinous crimes. Matthew Weiss’ extensive cyber assault on Plaintiffs’ basic privacy

rights is horrible, but it is the University of Michigan and its privacy vendors who

have failed to protect vulnerable student-athletes all over the nation whose most

private information now resides in the public domain.

JURISDICTION AND VENUE

4
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.68 Filed 04/13/25 Page 5 of 52

1. Plaintiff McKenzie Johnson was a student-athlete at Grambling State

University from 2015-2019, was a member of the Women’s Softball team, and

resides in Texas.

2. Plaintiff Jane Doe 1 was a student-athlete at the University of Michigan

from 2020 to 2024, was a member of the Michigan Women’s Volleyball team, and

resides in Union County, New Jersey.

3. Plaintiff Jane Doe 2 was a student-athlete at the University of Michigan

from 2020 to 2024, was a member of the Michigan Women’s Soccer team, and

resides in Washtenaw County, Michigan.

4. Plaintiff Jane Doe 3 has been a student-athlete at the University of

Michigan from 2022 to Present, is a member of the Michigan Dance Team, and

resides in Worcester County, Massachusetts.

5. Plaintiff Jane Doe 4 was a student-athlete at the University of Michigan

from 2020 to 2024, was a member of the Michigan Women’s Soccer team, and

resides in Oakland County, Michigan.

6. Plaintiff Jane Doe 5 was a student-athlete at the University of Michigan

from 2015 to 2019, was a member of the Michigan Women’s Lacrosse team, and

resides in New York County, New York.

5
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.69 Filed 04/13/25 Page 6 of 52

7. Plaintiff Jane Doe 6 was a student-athlete at the University of Michigan

from 2013 to 2017, was a member of the Michigan Women’s Gymnastics Team, and

resides in Suffolk County, Massachusetts.

8. Plaintiff Jane Doe 7 was a student-athlete at the University of Michigan

from 2018 to 2022, was a member of the Michigan Women’s Basketball team, and

resides in Hamilton County, Indiana.

9. Plaintiff Jane Doe 8 was a student-athlete at the University of Michigan

from 2013 to 2017, was a member of the Michigan Women’s Rowing team, and

resides in Kings County, New York.

10. Plaintiff Jane Doe 9 was a student-athlete at the University of Michigan

from 2019 to 2022, was a member of the Michigan Women’s Lacrosse team, and

resides in Washtenaw County, Michigan.

11. Plaintiff Jane Doe 10 was a student-athlete at the University of

Michigan from 2017 to 2022, was a member of the Michigan Women’s Lacrosse

team, and resides in New York County, New York.

12. Plaintiff Jane Doe 11 was a student-athlete at the University of

Michigan from 2020 to 2021, was a member of the Michigan Women’s Lacrosse

team, and resides in Washtenaw County, Michigan.

6
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.70 Filed 04/13/25 Page 7 of 52

13. Plaintiff Jane Doe 12 was a student-athlete at the University of

Michigan from 2015 to 2019, was a member of the Michigan Women’s Lacrosse

team, and resides in Cook County, Illinois.

14. Plaintiff Jane Doe 13 was a student-athlete at the University of

Michigan from 2016 to 2020, was a member of the Michigan Women’s Swimming

team, and resides in Porter County, Indiana.

15. Plaintiff Jane Doe 14 has been a student-athlete at the University of

Michigan from 2020 to Present, is a member of the Michigan Dance team, and

resides in Macomb County, Michigan.

16. Plaintiff Jane Doe 15 was a student-athlete at the University of

Michigan from 2015 to 2019, was a member of the Michigan Women’s Lacrosse

team, and resides in New York County, New York.

17. Plaintiff Jane Doe 16 was a student-athlete at the University of

Michigan from 2017 to 2021, was a member of the Michigan Women’s Field

Hockey team, and resides in Washtenaw County, Michigan.

18. Plaintiff Jane Doe 17 was a student-athlete at the University of

Michigan from 2018 to 2021, was a member of the Michigan Women’s Lacrosse

team, and resides in New York County, New York.

7
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.71 Filed 04/13/25 Page 8 of 52

19. Plaintiff Jane Doe 18 was a student-athlete at the University of

Michigan from 2015 to 2019, was a member of the Michigan Women’s Lacrosse

team, and resides in Lee County, Florida.

20. Plaintiff Jane Doe 19 was a student-athlete at the University of

Michigan from 2021 to 2025, was a member of the Michigan Dance team, and

resides in Oakland County, Michigan.

21. Plaintiff Jane Doe 20 was a student-athlete at the University of

Michigan from 2020 to 2024, was a member of the Michigan Women’s Field

Hockey team, and resides in Washtenaw County, Michigan.

22. Plaintiff Jane Doe 21 was a student-athlete at the University of

Michigan from 2018 to 2023, was a member of the Michigan Women’s Track and

Cross-Country teams, and resides in Washtenaw County, Michigan.

23. Plaintiff Jane Doe 22 was a student-athlete at the University of

Michigan from 2021 to 2025, was a member of the Michigan Dance team, and

resides in Oakland County, Michigan.

24. Plaintiff Jane Doe 23 was a student-athlete at the University of

Michigan from 2019 to 2023, was a member of the Michigan Dance team, and

resides in Milwaukee County, Wisconsin.

8
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.72 Filed 04/13/25 Page 9 of 52

25. Plaintiff Jane Doe 24 was a student-athlete at the University of

Michigan from 2016 to 2018, was a member of the Michigan Women’s Gymnastics

team, and resides in Hennepin County, Minnesota.

26. Plaintiff Jane Doe 25 was a student-athlete at the University of

Michigan from 2017 to 2021, was a member of the Michigan Women’s Field

Hockey team, and resides internationally.

27. Plaintiff Jane Doe 26 was a student-athlete at the University of

Michigan from 2017 to 2022, was a member of the Michigan Women’s

Lacrosse team, and resides in Somerset County, New Jersey.

28. Plaintiff Jane Doe 27 was a student-athlete at the University of

Michigan from 2017 to 2022, was a member of the Michigan Women’s Water Polo

team, and resides in Washtenaw County, Michigan.

29. Plaintiff Jane Doe 28 was a student-athlete at the University of

Michigan from 2015 to 2019, was a member of the Michigan Women’s Volleyball

team, and resides in Hamilton County, Indiana.

30. Plaintiff Jane Doe 29 was a student-athlete at the University of

Michigan from 2017 to 2021, was a member of the Michigan Women’s Field

Hockey team, and resides in Denver County, Colorado.

9
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.73 Filed 04/13/25 Page 10 of 52

31. Plaintiff Jane Doe 30 was a student-athlete at the University of

Michigan from 2017 to 2020, was a member of the Michigan Women’s Field

Hockey team, and resides internationally.

32. Plaintiff Jane Doe 31 was a student-athlete at the University of

Michigan from 2015 to 2019, was a member of the Michigan Women’s Soccer team,

and resides in Washtenaw County, Michigan.

33. Plaintiff Jane Doe 32 was a student-athlete at the University of

Michigan from 2017 to 2021, was a member of the Michigan Women’s Field

Hockey team, and resides in Kings County, New York.

34. Plaintiff Jane Doe 33 was a student-athlete at the University of

Michigan from 2014 to 2018, was a member of the Michigan Women’s Softball

team, and resides in Oakland County, Michigan.

35. Plaintiff Jane Doe 34 was a student-athlete at the University of

Michigan from 2016 to 2019, was a member of the Michigan Women’s Field

Hockey team, and resides internationally.

36. Plaintiff Jane Doe 35 was a student-athlete at the University of

Michigan from 2020 to 2024, was a member of the Michigan Women’s Swimming

team, and resides in Macomb County, Michigan.

10
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.74 Filed 04/13/25 Page 11 of 52

37. Plaintiff Jane Doe 36 was a student-athlete at the University of

Michigan from 2015 to 2020, was a member of the Michigan Women’s Lacrosse

team, and resides in New York County, New York.

38. Plaintiff Jane Doe 37 was a student-athlete at the University of

Michigan from 2019 to 2023, was a member of the Michigan Women’s Rowing

team, and resides in Suffolk County, Massachusetts.

39. Plaintiff Jane Doe 38 was a student-athlete at the University of

Michigan from 2016 to 2019, was a member of the Michigan Women’s Track and

Cross-Country teams, and resides in Washtenaw County, Michigan.

40. Plaintiff Jane Doe 39 was a student-athlete at the University of

Michigan from 2015 to 2018, was a member of the Michigan Women’s Softball

team, and resides in Saint Tammany County, Louisiana.

41. Plaintiff Jane Doe 40 was a student-athlete at the University of

Michigan from 2021 to 2025, was a member of the Michigan Women’s Rowing

team, and resides in Washtenaw County, Michigan.

42. Plaintiff Jane Doe 41 was a student-athlete at the University of

Michigan from 2015 to 2019, was a member of the Michigan Women’s Basketball

team, and resides in Bucks County, Pennsylvania.

11
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.75 Filed 04/13/25 Page 12 of 52

43. The Regents of the University of Michigan (the “Regents”) is a

corporate entity with the authority to be sued and is responsible for governing the

University, as per Mich. Comp. Laws § 390.3 and § 390.4.

44. The University of Michigan (the “University”) is a public institution

established under the laws of the State of Michigan.

45. The University has received and continues to receive state funding,

making it subject to Michigan state laws.

46. Keffer Development Services, LLC (“Keffer”) is a Pennsylvania-based

limited liability company that has consistently conducted business in Michigan by

directly providing services to residents and entities within the state, thereby availing

itself of Michigan's legal protections.

47. The wrongful conduct and legal violations committed by Keffer, as

outlined in this complaint, specifically affected Plaintiffs who resided in Michigan

at the time of the incidents.

48. Matthew Weiss (“Weiss”) is an individual residing in Michigan.

49. This Court has jurisdiction under 28 U.S.C. §§ 1331 and 1367, as this

case involves a claim under the Stored Communications Act, 18 U.S.C. § 2701(a) et

seq., supplemental jurisdiction over additional related claims under 28 U.S.C. §

1367(a), and subject matter jurisdiction pursuant to 28 U.S.C. §1332(d) because this

is a class action in which the amount in controversy exceeds $5,000,000, there are

12
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.76 Filed 04/13/25 Page 13 of 52

more than 100 putative class members, and the majority of putative class members

are citizens of a state different than the state of which Defendants are citizens.

50. Venue is proper in this district under 28 U.S.C. § 1391, as a substantial

portion of the events giving rise to these claims occurred within this jurisdiction, and

the Defendants are subject to personal jurisdiction here.

51. Plaintiffs’ injuries are redressable by monetary compensation and all of

Plaintiffs’ alleged injuries and those of the class members, are fairly traceable

to Defendants’ conduct

52. Plaintiffs are timely filing a Notice of Intent to File Claims in the Court

of Claims (“COC”) pursuant to MCL 600.6431.

INDIVIDUAL ALLEGATIONS

53. All Plaintiffs were female student-athletes at the University of

Michigan at all relevant times in which Weiss was employed by the University.

54. Upon information and belief, All Plaintiffs fell victim to Defendants’

conduct when Weiss unlawfully captured their private and sensitive personal records

from electronic mail sources without permission.

55. Weiss primarily targeted female college athletes, so he posed a greater

threat to All Plaintiffs who were prominent female student-athletes at the University

of Michigan.

13
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.77 Filed 04/13/25 Page 14 of 52

56. Weiss targeted All Plaintiffs by infiltrating athlete databases that were

maintained by Defendant Keffer, from which he gained access to by virtue of his

elevated level of access as an Offensive Coordinator for the Michigan football team.

INDIVIDUAL AND CLASS ALLEGATIONS

57. Weiss was employed by the University.

58. Weiss’ conduct occurred during his employment at the University.

59. The Regents had a responsibility to oversee the University’s operations

and ensure it upheld ethical standards and protected its students.

60. This duty of care was violated when the Regents and University

personnel failed to adequately supervise Weiss, resulting in the unlawful invasion of

privacy affecting Plaintiffs and thousands of others.

61. Plaintiffs are current and former student-athletes at the University and

other affected institutions who were specifically targeted and harmed due to this

violation of their privacy by Defendants.

62. The Regents were also charged with managing the University’s

policies, financial operations, and strategic decisions, including budget approvals,

tuition determination, and infrastructure development.

63. They failed in this obligation by neglecting to implement or enforce

policies that would have ensured proper oversight of University personnel, including

Weiss, thereby preventing the breach of privacy that affected Plaintiffs.

14
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.78 Filed 04/13/25 Page 15 of 52

64. The Regents did not take any measures to prevent the harm inflicted

upon Plaintiffs and other students as outlined in this Complaint.

65. The Regents had the responsibility to establish University policies

ensuring the monitoring of personnel in positions of authority, such as Weiss who

was the Offensive Coordinator of the Michigan football team, but failed to do so,

thereby exposing students to privacy violations.

66. The Regents and the University were required to ensure that student-

athletes had access to services from professionals who would respect their privacy.

67. The Regents and the University acted recklessly by not ensuring that

student-athletes’ personal and sensitive information, including that of Plaintiffs, was

securely managed, despite being entrusted to do so.

68. The Regents and the University have a duty to support Plaintiffs and

take appropriate security measures to protect private information and images.

69. They breached this duty by failing to consider or implement any

meaningful security measures to safeguard Plaintiffs’ sensitive personal data.

70. As financial stewards of the University, the Regents and the University

failed to responsibly allocate resources by prioritizing cost avoidance over

implementing security measures that could have prevented the privacy breaches.

15
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.79 Filed 04/13/25 Page 16 of 52

71. The Regents, responsible for overseeing all University of Michigan

campuses, failed to enforce policies that could have detected, investigated, or

prevented Weiss’ unlawful actions, which were facilitated by the University’s access

provisions.

72. The University, like the Regents, failed to uphold these responsibilities

and engaged in similar breaches of duty.

73. Plaintiffs entrusted the University to protect their private images and

information.

74. The University neglected this heightened responsibility, recklessly

allowing Weiss to access and exploit the private information and images of Plaintiffs

and other student-athletes.

75. The Regents also had general oversight authority over the University’s

expenditures, yet failed to ensure that public funds were allocated to establish

security protocols that would have protected student-athletes’ private information.

76. The University employed Weiss and had authority over him.

77. The University assigned and directed Weiss’ job responsibilities.

78. These job duties enabled Weiss to access and exploit private, intimate

information and images of Plaintiffs and others, which had been entrusted to the

University for safekeeping.

16
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.80 Filed 04/13/25 Page 17 of 52

79. Despite providing Weiss with the means to invade Plaintiffs’ privacy,

the University failed to supervise or monitor his actions.

80. The University betrayed the trust of Plaintiffs and others by granting

Weiss electronic credentials that allowed him to surveil student-athletes, including

Plaintiffs, and access their personal information and images.

81. Without any University oversight, Weiss, in the course of his

employment, unlawfully accessed and exploited Plaintiffs’ private data.

82. The Regents, the University, and Weiss engaged in misconduct,

recklessness, and wrongdoing, which also implicated Keffer.

83. Keffer’s negligence and reckless disregard contributed to Weiss’

privacy violations against Plaintiffs and their fellow student-athletes.

84. Keffer had agreed to securely store and manage Plaintiffs’ sensitive

data, ensuring it remained inaccessible to University employees like Weiss and

unauthorized third parties.

85. Keffer was aware that the information it stored for Plaintiffs and others

was private, personal, and sensitive.

86. Keffer had an explicit obligation to protect this sensitive data but failed

to fulfill this duty.

87. By failing to implement any policies, procedures, or security measures,

Keffer breached its duty to protect the private information entrusted to it by Plaintiffs

17
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.81 Filed 04/13/25 Page 18 of 52

and others.

88. As a direct result of Keffer’s security failures, Weiss was able to access

Plaintiffs’ private, personal, and intimate images and information.

89. Keffer collects personal data about students and student-athletes.

90. The University and the Regents sanctioned Keffer’s collection of this

private information.

91. Plaintiffs trusted that the University and the Regents’ authorization of

Keffer’s role would ensure the safety and confidentiality of their data.

92. The Regents and the University took no action to ensure that Keffer

maintained the privacy of Plaintiffs’ sensitive information.

93. The Regents’ negligence in this regard directly harmed Plaintiffs.

94. The University’s failure to safeguard this data also caused harm to

Plaintiffs.

95. Keffer failed to implement measures to protect Plaintiffs’ private

information, leading to its unauthorized access.

96. Keffer took no precautions to prevent Weiss from accessing Plaintiffs’

personal information and images.

97. Due to the negligence and recklessness of Keffer, the Regents, and the

University, Weiss was able to unlawfully obtain and misuse sensitive information

belonging to Plaintiffs and others.

18
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.82 Filed 04/13/25 Page 19 of 52

98. Between approximately 2015 and January 2023, Weiss unlawfully

accessed the digital accounts of over 3,300 individuals, including Plaintiffs and other

University student-athletes, as detailed in the criminal indictment against him.

99. Weiss was able to do so because the University and the Regents granted

him access credentials, enabling him to obtain and misuse private images and

information.

100. The Non-Individual Defendants failed to monitor Weiss’ activities,

supervise his conduct, review his employment status, or ensure that his job duties

were performed in a manner that respected Plaintiffs’ privacy.

101. The Non-Individual Defendants failed to implement even basic security

measures such as multi-factor authentication, background checks, peer oversight, or

routine audits to protect student-athletes’ private information.

102. As a result of these failures, Weiss was able to unlawfully access

private, intimate information belonging to Plaintiffs and their peers, which was

maintained by Keffer and authorized for collection by the University and the

Regents.

103. The careless, negligent, and improper actions of the Regents, the

University, and Keffer facilitated Weiss’ ability to target female college athletes and

access their private and sensitive information without authorization, including but

not limited to the Plaintiffs.

19
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.83 Filed 04/13/25 Page 20 of 52

104. The Non-Individual Defendants were aware that Weiss, due to his job

responsibilities, had a significant advantage in accessing private information and the

personal privacy interests of the Plaintiffs and their peers.

105. The Regents, the University, and Keffer failed to implement reasonable

security measures or conduct background checks on Weiss, which allowed him to

freely research, target, and invade the privacy of multiple University athletes,

particularly female athletes, who were primarily selected based on their school

affiliation, athletic history, and physical attributes.

106. The failure of the Regents, the University, and Keffer to supervise

Weiss, review his conduct, assess his credentials, monitor his work, or ensure

oversight enabled him to exploit Plaintiffs and others without any reporting of his

actions. As a result, Weiss was able to acquire private photographs and videos of

Plaintiffs and others that were meant to remain confidential and only be shared with

intimate partners.

107. Due to the recklessness of the University, the Regents, and the gross

negligence of Keffer, Weiss was able to download personal and intimate digital

photographs and videos of Plaintiffs and other class members who had entrusted this

information to the Non-Individual Defendants.

108. The Non-Individual Defendants’ failure to exercise control over Weiss,

despite their duty to do so, allowed him to exploit his job position to target athletes

20
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.84 Filed 04/13/25 Page 21 of 52

such as Plaintiffs, access, obtain, and misuse their private information, images, and

videos.

109. Because the Non-Individual Defendants failed to monitor Weiss, he

was able to compile detailed records on individuals whose private photographs and

videos he sought to obtain. Their failure to implement protective measures was so

severe that Weiss even documented comments regarding the bodies and sexual

preferences of Plaintiffs and their peers.

110. The information that Weiss acquired due to the Non-Individual

Defendants’ negligence is highly confidential, personal, and distressing when

exposed without authorization, causing humiliation and embarrassment.

111. Weiss accessed, without authorization or exceeding authorization,

student-athlete databases from over 100 colleges and universities nationwide,

maintained by Keffer.

112. Thousands of students remain at risk because, despite decades of

complaints and reports of misconduct within athletic departments, the University,

the Regents, and Keffer repeatedly failed to review how Plaintiffs’ personal data was

stored, maintained, and accessed.

113. The University and the Regents neglected to investigate Keffer’s

protocols or implement safeguards regarding Keffer’s work with students and their

private images, failing to uphold their duty to protect entrusted personal data.

21
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.85 Filed 04/13/25 Page 22 of 52

114. The University and the Regents also failed to explore or establish

preventive measures to shield students from Weiss’ actions.

115. Neither the University nor the Regents have provided any explanation

or justification for their failure to review Keffer’s contract, investigate Keffer’s

practices, implement oversight mechanisms, or consider measures to prevent

students’ exposure to Weiss.

116. Due to the lack of control and enabling behavior of the Non-Individual

Defendants, Weiss was able to gain unauthorized access to databases containing

highly sensitive and private information belonging to Plaintiffs and others.

117. Many, if not all, of these databases were maintained by Keffer and were

entrusted to him with the expectation of being securely safeguarded.

118. Plaintiffs entrusted the University and the Regents to ensure that Keffer

adequately protected their private information and images.

119. Defendants completely failed to implement or execute any reasonable

security measures that could have safeguarded Plaintiffs’ private information from

Weiss’ unauthorized access.

120. Exploiting unsecured databases, Weiss downloaded personally

identifiable information (PII) and medical records of more than 150,000 athletes,

including Plaintiffs.

121. Weiss also downloaded athlete passwords used to access Keffer’s

22
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.86 Filed 04/13/25 Page 23 of 52

computer system to view and update their data, including Plaintiffs’ credentials.

122. The athletes’ passwords were encrypted but were poorly secured due to

the Non-Individual Defendants’ recklessness. Consequently, Weiss, who was left

unsupervised, managed to crack the encryption using basic internet research.

123. Through open-source research, Weiss further investigated targeted

athletes, such as Plaintiffs, collecting personal details like their mothers’ maiden

names, pets’ names, birthplaces, and nicknames—information Plaintiffs had

entrusted to the Non-Individual Defendants but which was inadequately protected.

124. Using a combination of data obtained from student-athlete databases

and additional research, Weiss, due to the lack of oversight by the Non-Individual

Defendants, was able to gain access to over 2,000 athletes’ social media, email, and

cloud storage accounts, including those belonging to Plaintiffs.

125. Once inside these accounts, Weiss searched for and downloaded private

and intimate photographs and videos that were not publicly available.

126. Weiss also accessed, without authorization, the social media, email, and

cloud storage accounts of more than 1,300 additional students and alumni from

universities across the country, including Plaintiffs, due to the reckless disregard for

their safety and privacy by the Non-Individual Defendants.

127. Upon accessing these accounts, Weiss extracted personal and intimate

content.

23
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.87 Filed 04/13/25 Page 24 of 52

128. The Regents, University, and Keffer have also failed to take any steps

to address or remedy the harm and privacy violations they allowed to occur.

129. Weiss exploited weaknesses in account authentication processes to gain

further access to additional accounts of students and alumni, leveraging this access

to infiltrate more social media, email, and cloud storage accounts.

130. The Regents, University, and Keffer failed to take preventive action

against such unauthorized access.

131. The Non-Individual Defendants were long aware that the type of data

Weiss accessed was expected to remain private and that any breach would cause

significant harm. Despite this knowledge, they failed to implement appropriate

safeguards to protect the confidential information entrusted to them by Plaintiffs and

other student-athletes.

132. From approximately 2015 to January 2023, Weiss intentionally

accessed, without authorization, personal and private information belonging to

Plaintiffs and others, including data stored on university servers, social media, email,

and cloud platforms.

133. Weiss unlawfully obtained digital photographs, videos, and personal

data from more than 3,300 individuals, including Plaintiffs, violating privacy laws

in Michigan, Maryland, and Pennsylvania.

24
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.88 Filed 04/13/25 Page 25 of 52

134. Weiss took advantage of security vulnerabilities and the lack of

supervision by the Non-Individual Defendants to reset account passwords, access

private accounts, and further compromise Plaintiffs’ digital security.

135. In an email dated January 25, 2023 with the subject “University of

Michigan Police Department Investigation,” Detective John Buehler wrote:

I am contacting you regarding your University of

Michigan email account. The University of Michigan
Police Department is conducting a criminal investigation
into multiple accounts that have been accessed without
authorization. That report number is [0063]. We have
information that your account was accessed and your
personal information may have been compromised.

136. In an email dated February 13, 2023 with the subject “Notification:

Unauthorized Access of Your UMICH Account,” the U-M Privacy Office wrote:

In late December 2022, potentially unauthorized activity

in your U-M Google account was identified. As part of
the U-M cybersecurity team’s investigation, they
discovered that a threat actor manipulated a flaw in self-
service password-recovery (“Forgot password”) to change
your password and gain unauthorized access to your U-M
Google account. These findings were escalated to UMPD,
which subsequently launched a criminal investigation.

Based on the U-M cybersecurity team’s investigation, it

appears that the threat actor gained unauthorized access to
some of your accounts and/or data. They also logged into
your U-M account management settings, where they may
have viewed and/or changed your password recovery
phone number and password recovery email address.
Additionally, they logged into your M+Google email

25
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.89 Filed 04/13/25 Page 26 of 52

and/or Google Drive. The U-M cybersecurity team was

unable to tell which emails or files they may have accessed
or deleted while logged in, or whether your email settings
were altered.

While there is no evidence at this time that the threat actor

accessed additional personal information in your account,
it is possible they may have accessed other accounts linked
to your U-M email address (online banking, social media,
password management, etc.).

***
We are aware of how important your personal information
is to you and deeply regret that this situation occurred. The
University of Michigan is committed to maintaining a
secure computing environment, preserving the
confidentiality of the information we maintain, and
constantly reviewing and improving our security
practices.

137. In an email dated October 28, 2023 with the subject “Investigation

Update,” Detective John Buehler wrote “I am reaching out to you again regarding

the University of Michigan’ Police Department’s investigation into the unauthorized

access of your accounts. As the investigation progressed, we found it necessary to

partner with the Federal Bureau of Investigation. Currently, the investigation is

extensive, ongoing, and is of the utmost priority. Additional information will be

provided when available.”

138. As a direct result of the negligence, recklessness, and misconduct of the

Non-Individual Defendants, Plaintiffs have suffered substantial financial and

emotional damages exceeding $75,000, exclusive of costs, interest, and legal fees.

26
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.90 Filed 04/13/25 Page 27 of 52

139. Plaintiffs file this lawsuit both individually and as a class action on

behalf of all those similarly affected under Rule 23.

140. This case meets the requirements of numerosity, commonality,

predominance, typicality, and adequacy as outlined in the rule.

141. The Class is currently defined as: All individuals whose personal data,

images, social media, or videos were accessed by Weiss without authorization

(referred to as “Class Members”).

142. Numerosity: While the exact number of Class Members is not currently

known and will be determined through further discovery, it is significant enough to

make individual joinder impractical.

143. Law enforcement officials have confirmed that there are a substantial

number of victims, satisfying the numerosity requirement.

144. Resolving the claims of these Class Members in a single action will

benefit all parties and the Court by conserving resources, preventing inconsistent

rulings, and providing a fair and efficient method for adjudication.

145. Class Members can be readily identified through information and

records held by federal and state authorities, the Regents, the University, and Keffer.

146. Electronic records maintained by the Non-Individual Defendants, who

conducted their own investigations, can confirm the identities of Class Members.

27
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.91 Filed 04/13/25 Page 28 of 52

147. Commonality: The evidence establishing how, when, where, and

through what means Plaintiffs and other Class Members experienced these invasions

is best evaluated collectively.

148. Defendants’ actions, inactions, negligence, and recklessness apply

uniformly to all Plaintiffs and Class Members.

149. Weiss’ unauthorized downloads and access to private information

through insecure systems affected all Class Members in essentially the same manner,

causing identical types of harm.

150. The majority of legal and factual issues relevant to Plaintiffs and Class

Members are common and take precedence over any individual matters.

151. Plaintiffs’ claims are representative of those of the Class Members, as

they share a common origin in terms of timing, circumstances, and harm suffered.

152. Plaintiffs are well-suited to represent the class, as they are committed

to seeking justice and adequately reflect the harm experienced by the Class

Members.

153. Pursuing this case as a class action is the most effective approach,

facilitating the fair administration of justice because:

a. Separate lawsuits by individual Class Members could lead to

inconsistent rulings, imposing conflicting obligations on
Defendants.

b. Many victims may not come forward unless a class is certified.

28
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.92 Filed 04/13/25 Page 29 of 52

c. Comprehensive equitable relief—including monitoring,

protection, therapy, and other necessary measures—can be
appropriately provided for the entire Class.

d. A class action is the most practical and manageable way to

address these claims.

e. Without a class action, individual Class Members may remain

unaware of whether they were recorded, where their private
images are stored, or who may have access to them, leaving their
injuries unresolved.

f. Individual Class Members may have little incentive or ability to

pursue separate legal actions on their own.

COUNT I – VIOLATION OF THE COMPUTER FRAUD

AND ABUSE ACT – 18 U.S.C. § 1030

154. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

155. Weiss violated the Computer Fraud and Abuse Act by unlawfully

accessing Plaintiffs’ private information without authorization.

156. He did so in the course of his assigned job responsibilities at the

University.

157. Weiss’ actions constitute a violation of the Act because he “knowingly

accessed a computer without authorization” and/or “exceeded authorized access,

thereby obtaining... information.” 18 U.S.C. § 1030(a)(2)(C).

158. Under the law, Weiss qualifies as an “inside hacker” since he initially

accessed a computer system with legitimate credentials as part of his work with

Plaintiffs and Class Members in their capacity as student-athletes. However, he then

29
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.93 Filed 04/13/25 Page 30 of 52

surpassed the scope of his permitted access by entering restricted areas of the digital

network.

159. This situation is comparable to opening your office door only to

discover an unauthorized individual inside. If the intruder is an unknown person with

no right to be in the building, they are completely unauthorized. If it’s a colleague

from a different department, they have exceeded their permitted access.

160. Weiss’ actions were deliberate, as he was fully aware that he was not

authorized to access the restricted information but did so regardless, with the

University’s implicit approval.

161. The University is vicariously liable for Weiss’ actions, as he conducted

them while performing his duties as a medical sports staff member within the

University’s athletic department.

162. Legal precedent establishes that an employer is responsible for the

wrongful acts committed by its agents in the course of their employment.

163. Under 18 U.S.C. § 1030(g), Plaintiffs are entitled to seek damages from

Weiss and the University through this civil action, as well as injunctive or other

equitable relief.

164. Given the willful violations committed by Weiss and the University,

which resulted in significant harm, humiliation, and distress to Plaintiffs and the

Class, Plaintiffs should be awarded all appropriate damages in this case.

30
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.94 Filed 04/13/25 Page 31 of 52

COUNT II – VIOLATIONS OF THE STORED COMMUNICATIONS ACT

165. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

166. The Stored Communications Act, 18 U.S.C. § 2701 et seq., prohibits

the unauthorized access of web-based cloud storage, media accounts, and other

digital platforms, including those maintained by Keffer, which contained highly

personal, private, and sensitive information belonging to Plaintiffs and others in

similar situations.

167. Specifically, under 18 U.S.C. § 2701(a), it is unlawful for any person

to (1) knowingly and intentionally access, without authorization, a system through

which an electronic communication service is provided; or

(2) intentionally exceed authorized access to such a system and, in doing so, obtain,

modify, or obstruct authorized access to electronic communications while they are

stored in that system.

168. Plaintiffs’ digital communications and personal information were

electronically stored and clearly fall within the scope of the statute’s protections.

169. Weiss accessed Plaintiffs’ private data—including messages, files, and

media—without authorization while performing duties associated with his role at the

University.

31
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.95 Filed 04/13/25 Page 32 of 52

170. His actions in accessing Plaintiffs’ data without permission were

deliberate and undertaken knowingly in connection with his employment.

171. Plaintiffs’ private messages, files, and media could not have been

accessed without unauthorized entry, and such access would not have occurred had

Weiss not been employed by the University in his specific role within sports

medicine.

172. Under Section 2707 of the Stored Communications Act, individuals

affected by violations of this statute are entitled to pursue civil action.

173. This law imposes strict liability on violators.

174. The statute permits affected individuals to seek remedies including

equitable and declaratory relief, actual damages (or statutory damages of at least

$1,000 per violation), punitive damages, as well as reasonable attorneys’ fees and

litigation expenses, pursuant to 18 U.S.C. § 2707(b)-(c).

175. Weiss and the University’s unauthorized access to Plaintiffs’ private

information, including messages, files, and media, constituted a violation of 18

U.S.C. § 2701(a).

176. Both Weiss and the University were fully aware that they had no legal

authority to access this data but did so regardless.

177. Their intentional misconduct led to multiple violations of the Stored

Communications Act.

32
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.96 Filed 04/13/25 Page 33 of 52

178. As a result of these violations, Plaintiffs have suffered significant

financial and non-financial harm and seek appropriate compensation for their

damages.

179. Under the statute, Plaintiffs are entitled to recover either (1) their actual

damages combined with any profits gained by Weiss and the University from the

violations or (2) statutory damages of at least $1,000 per violation.

180. Given the deliberate nature of these violations, the Court should impose

punitive damages against the Defendants.

181. Plaintiffs are also entitled to reimbursement for reasonable attorneys'

fees and legal costs.

COUNT III – VIOLATION OF TITLE IX, 20 U.S.C. § 1681(A) et seq.

182. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

183. Title IX mandates that “No person in the United States shall, on the

basis of sex, be … subjected to discrimination under any education program or

activity receiving Federal financial assistance …”

184. Each Plaintiff qualifies as a "person" under the statutory language of

Title IX.

185. Weiss specifically targeted women in his unwarranted privacy

violations, constituting sex-based discrimination.

33
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.97 Filed 04/13/25 Page 34 of 52

186. The University receives federal financial support for its educational

programs, making it subject to Title IX of the Education Amendments of 1972, 20

U.S.C. § 1681(a), et seq.

187. Under Title IX, the University is obligated to investigate allegations of

sexual harassment.

188. The University was aware of the highly sensitive nature of the

Plaintiffs’ private and personal information, which Weiss was able to access due to

his position.

189. The University and Regents displayed deliberate indifference to sexual

harassment by:

a. Failing to protect Plaintiffs and others in accordance with Title

IX requirements;

b. Neglecting to properly investigate and address concerns

regarding the deeply private information Plaintiffs entrusted to
them;

c. Not implementing corrective measures to prevent Weiss from

engaging in further sexual harassment of students; and

d. Failing to investigate additional acts of deliberate indifference

adequately.

190. The University and Regents' failure to respond appropriately to sexual

harassment was clearly unreasonable given the known circumstances, constituting

deliberate indifference.

34
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.98 Filed 04/13/25 Page 35 of 52

191. Due to the University's inadequate protection, investigation, and

response to the harassment of female students, Plaintiffs have been effectively

denied equal educational opportunities, including access to medical care and athletic

training.

192. At the time Plaintiffs received certain medical training services from

the University, they were unaware that the Defendants had failed to properly

consider their safety in relation to Weiss’ hiring, training, and supervision.

193. As a direct result of the deliberate indifference shown by the University

and Regents, Plaintiffs have suffered a loss of educational benefits and opportunities.

194. Plaintiffs have incurred and will continue to incur attorneys’ fees and

litigation costs.

195. At the time of Defendants’ wrongful conduct, Plaintiffs were either

unaware or, despite reasonable diligence, could not have been aware of the

institutional failures of Defendants concerning their Title IX obligations.

196. The University and Regents maintained a policy and/or practice of

deliberate indifference toward the protection of female student-athletes.

197. This policy and/or practice of disregarding female athletes’ privacy

rights contributed to an increased risk of sexual harassment.

198. Despite having the power to prevent these privacy violations and acts

of harassment, Defendants failed to do so.

35
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.99 Filed 04/13/25 Page 36 of 52

199. Due to the University’s and Regents’ policy and/or practice of

deliberate indifference, Plaintiffs were subjected to privacy invasions and sexual

harassment by Weiss.

200. Plaintiffs should be awarded damages for the substantial harm,

humiliation, and distress caused by the University’s and Regents’ actions and

inactions.

COUNT IV -- VIOLATION OF CIVIL RIGHTS UNDER 42 U.S.C. § 1983 –

STATE CREATED DANGER

201. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

202. The Fourteenth Amendment’s Due Process Clause prohibits the state

from depriving individuals of life, liberty, or property without due process of law.

203. The Regents and the University knowingly and recklessly exposed

Plaintiffs to a dangerous individual, Weiss, despite being aware of his potential to

inflict serious harm through sexual harassment and violations of their privacy.

204. Plaintiffs, as female student-athletes, were foreseeable victims of such

misconduct.

205. The violation of Plaintiffs’ privacy rights was entirely foreseeable.

206. The Regents and the University took affirmative actions that deprived

Plaintiffs of a safe campus environment, thereby creating or heightening the risk of

harm and leading to both physical and emotional suffering.

36
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.100 Filed 04/13/25 Page 37 of 52

207. The University and the Regents demonstrated a reckless disregard for

Plaintiffs’ safety.

208. Through their decisions and actions, the University and the Regents

failed to provide a secure campus, directly contributing to Plaintiffs’ exposure to

harm and emotional distress.

209. The University and the Regents willfully neglected their duty to

safeguard Plaintiffs.

210. Plaintiffs are entitled to recover all applicable damages for the Regents’

and the University’s actions, which caused severe harm, humiliation, and emotional

distress to Plaintiffs and the Class.

COUNT V – FAILURE TO TRAIN AND SUPERVISE 42 U.S.C. § 1983

211. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

212. The University and the Regents bore the ultimate responsibility and

authority to train and oversee their employees, agents, and representatives, including

Weiss, as well as all faculty and staff, in fulfilling their duties toward students,

faculty, staff, and visitors.

213. The University and the Regents neglected to properly train and

supervise their employees, agents, and representatives, including all faculty and

staff, regarding their obligations, which included but were not limited to:

37
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.101 Filed 04/13/25 Page 38 of 52

a. Recognizing, addressing, and preventing incidents of sexual

harassment on campus;

b. Identifying, reporting, and preventing unauthorized invasions of

privacy on campus;

c. Ensuring diligent oversight of student athletes and other

individuals, including Weiss;

d. Conducting thorough investigations into any privacy invasions

committed by Weiss;

e. Safeguarding all students, faculty, staff, and visitors on UM’s

campus premises;

f. Maintaining a campus environment free from sexual harassment

and invasions of privacy;

g. Providing adequate training to faculty and staff regarding their

individual responsibility in fostering and upholding a safe
campus environment.

214. The University and the Regents failed to sufficiently educate and train

coaches, trainers, medical staff, Weiss, and other relevant personnel regarding the

aforementioned responsibilities, which ultimately resulted in violations of Plaintiffs’

rights.

215. The failure of the University and the Regents to provide adequate

training stemmed from their deliberate indifference toward the safety and well-being

of student athletes.

216. This lack of proper training directly contributed to or was the cause of

Plaintiffs’ injuries.

38
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.102 Filed 04/13/25 Page 39 of 52

217. Consequently, the University and the Regents deprived Plaintiffs of

rights protected under the Fourteenth Amendment to the United States Constitution,

constituting a violation of 42 U.S.C. § 1983.

218. Plaintiffs are entitled to full compensation for the harm, distress, and

humiliation they endured due to the Regents’ and the University’s actions and

inaction.

COUNT VI – INVASION OF PRIVACY INTRUSION UPON SECLUSION

(As to Defendant Weiss)

219. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

220. Plaintiffs’ personal social media content, videos, and other images were

stored electronically and were intended to remain private.

221. Weiss unlawfully accessed this private and personal information.

222. His actions were unauthorized.

223. This information would not have been obtained had the Non-Individual

Defendants properly monitored and supervised access.

224. Plaintiffs never granted permission for such access.

225. Plaintiffs feel embarrassed, ashamed, humiliated, and deeply distressed

that their private information has been exposed to strangers and third parties.

226. Plaintiffs’ social media data, images, and videos are inherently private.

39
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.103 Filed 04/13/25 Page 40 of 52

227. Plaintiffs had a rightful expectation that this information would remain

confidential.

228. The methods Weiss used to access the information were objectively

unreasonable.

229. As a result of Defendant’s actions, Plaintiffs have suffered substantial

financial and emotional harm and seek appropriate compensation.

COUNT VII – GROSS NEGLIGENCE

(As to Defendant Weiss)

230. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

231. Plaintiffs’ personal social media content, including files, videos, and

images, were stored electronically and were meant to remain private.

232. Weiss unlawfully accessed Plaintiffs’ private and personal information.

233. Weiss acted without authorization.

234. Plaintiffs never granted permission for such access.

235. Plaintiffs feel deep embarrassment, shame, humiliation, and distress

knowing that their private information has been exposed to strangers and third

parties.

236. Plaintiffs’ social media content, including images and videos, is

inherently private.

40
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.104 Filed 04/13/25 Page 41 of 52

237. Plaintiffs had a fundamental right to maintain the confidentiality of this

information.

238. As a direct result of Defendants’ actions, Plaintiffs have suffered both

financial and non-financial harm and are entitled to appropriate compensation.

COUNT VIII – NEGLIGENT HIRING OF KEFFER

239. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

240. Plaintiffs’ personal social media files, videos, and other images were

stored electronically and should have remained private.

241. The University neglected to evaluate, review, and assess whether Weiss

possessed the necessary training, character, and respect for students to ensure their

privacy was upheld and not violated.

242. Weiss wrongfully accessed Plaintiffs’ private and personal information.

243. Weiss’ actions were unauthorized.

244. This unauthorized access occurred due to the University’s failure to

establish appropriate hiring and training standards for Weiss’ role, failure to verify

his credentials, failure to conduct a thorough background review, and failure to

implement safeguards to ensure that individuals handling sensitive information were

properly vetted and did not abuse their position of trust.

41
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.105 Filed 04/13/25 Page 42 of 52

245. Plaintiffs never consented to Weiss’ access and were never consulted

regarding his fitness for the position.

246. Plaintiffs feel embarrassed, ashamed, humiliated, and distressed

knowing that their private information has been accessed by strangers and third

parties.

247. Plaintiffs’ social media content, images, and videos are highly personal

and private.

248. Plaintiffs had a fundamental right to keep such information

confidential.

249. Plaintiffs relied on the University to take appropriate measures to

secure, safeguard, and prevent unauthorized access to their private information.

250. The University acknowledges this responsibility.

251. The University failed in its duty to adequately assess Weiss’

credentials, training, and the necessary qualifications for his role.

252. Had the University fulfilled this duty, Plaintiffs would not have

suffered harm.

253. However, Plaintiffs did suffer harm.

254. The University’s negligence in failing to ensure Weiss was properly

trained and would adhere to security measures protecting Plaintiffs’ sensitive and

private information directly resulted in harm.

42
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.106 Filed 04/13/25 Page 43 of 52

255. Given the highly sensitive nature of Plaintiffs’ personal data, the

University was aware that it needed to exercise greater diligence in its hiring process.

256. The University failed in this responsibility.

257. As a result, Plaintiffs suffered harm.

258. Plaintiffs have endured significant financial and emotional damages

due to Defendants’ actions and seek appropriate compensation.

COUNT IX – NEGLIGENT TRAINING, SUPERVISION, AND

ENTRUSTMENT, AND RETENTION
(As to Defendant University of Michigan)

259. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

260. The University neglected to evaluate, establish, or enforce any policies,

procedures, or reasonable safeguards that would have educated Weiss on the harm

caused by invading Plaintiffs’ and the Class’s private information.

261. As a prominent institution, the University of Michigan led Plaintiffs to

reasonably expect that a coach would be properly trained to respect and protect their

personal and private information.

262. Plaintiffs reasonably did not anticipate that the University would fail to

provide Weiss with proper training on the sensitive nature of his role, leaving him

unchecked and enabling him to violate Plaintiffs' rights, causing them humiliation

and distress.

43
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.107 Filed 04/13/25 Page 44 of 52

263. The University’s failure to train Weiss resulted in harm to students,

including Plaintiffs.

264. Additionally, the University had a duty—but failed—to develop and

enforce a policy to ensure Weiss was trained to protect students like Plaintiffs from

predatory behavior.

265. The University’s failures were unreasonable.

266. The University had a duty to oversee Weiss in a way that would prevent

him from violating students’ privacy, including that of Plaintiffs.

267. The University neglected to assess, implement, or establish any policy,

procedure, or reasonable safeguard that would have ensured proper oversight and

monitoring of Weiss in handling the sensitive information entrusted to him by

Plaintiffs and the Class.

268. As a well-established institution, the University of Michigan led

Plaintiffs to reasonably expect that a coach would be adequately supervised to

protect their personal and private information.

269. Plaintiffs had no reason to anticipate that the University would fail to

properly oversee Weiss, leaving him unchecked in a position of trust where he could

violate Plaintiffs’ rights, causing them embarrassment and humiliation.

44
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.108 Filed 04/13/25 Page 45 of 52

270. The University was also obligated—but failed—to implement and

follow a policy ensuring Weiss was properly supervised to protect students like

Plaintiffs from potential predators.

271. Had the University fulfilled its responsibilities, Plaintiffs would not

have suffered harm, nor would their electronically stored social media files, videos,

and images have been accessed without their consent, violating their privacy.

272. The University has a history of privacy invasions and misconduct

within its athletic department, including incidents affecting student-athletes.

273. The University had a responsibility to retain Weiss only if he would not

perpetuate that troubling history.

274. The University was obligated to retain Keffer only if it ensured the

protection of Plaintiffs’ private information.

275. The University had previously been warned about the risks posed by

external vendors who could compromise student-athletes’ privacy.

276. The University had also been cautioned about the potential threats

posed by its own athletic department personnel, including trainers, in violating

student-athletes’ privacy.

277. Despite these warnings and the University’s prior experiences, the

Regents and the University proceeded to hire and retain Weiss, who ultimately

violated Plaintiffs’ privacy along with that of others.

45
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.109 Filed 04/13/25 Page 46 of 52

278. Plaintiffs have suffered significant financial and non-financial harm

due to Defendants’ actions and seek appropriate compensation.

COUNT X – TRESPASS TO CHATTELS

(As to Defendant Weiss)

279. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

280. Weiss and the University intentionally and unlawfully accessed

Plaintiffs’ private and personal information, including images, videos, and social

media, thereby wrongfully asserting control over and interfering with their sensitive

data without authorization.

281. This unauthorized access and control were deliberate and carried out

with malicious intent.

282. As a direct result of Weiss’ and the University’s intentional misconduct,

Plaintiffs and the Class have suffered substantial financial and non-financial harm.

283. Plaintiffs are entitled to exemplary damages due to the intentional,

harmful interference with, and wrongful exertion of control over, their private and

personal information.

COUNT XI – VIOLATIONS OF MCL § 600.2919a

(As to Defendants Weiss & Keffer)

284. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

46
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.110 Filed 04/13/25 Page 47 of 52

285. Michigan Compiled Laws (MCL) § 600.2919a states:

(1) An individual who suffers harm due to either or both of the

following may recover three times the amount of actual damages
sustained, along with costs and reasonable attorney fees:

(a) Another individual stealing, embezzling, or wrongfully

converting property for their own use.

(b) Another individual purchasing, receiving, possessing,

concealing, or assisting in the concealment of stolen, embezzled,
or converted property, with knowledge that the property was
unlawfully obtained.

(2) The remedy provided under this statute is supplemental to any other
legal or equitable right or remedy available.

286. Plaintiffs suffered harm due to the University and Weiss acquiring,

concealing, assisting in the concealment of, stealing, and/or misappropriating

Plaintiffs’ private and personal information. They also wrongfully used Plaintiffs'

images, videos, and data for their own benefit.

287. Pursuant to MCL § 600.2919a, Plaintiffs are entitled to recover three

times the actual damages sustained, in addition to costs and reasonable attorney fees.

COUNT XII – ASSAULT

(As to Defendant Weiss)

288. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

289. Defendant’s conduct, in accessing Plaintiffs’ personal and private

information as outlined above, was intentional.

47
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.111 Filed 04/13/25 Page 48 of 52

290. Defendant’s conduct was without consent or legal justification.

291. Defendant’s conduct caused a reasonable apprehension of imminent

harm to Plaintiffs.

292. As a result of Defendant’s conduct, Plaintiffs suffered severe damages.

COUNT XIII – INTENTIONAL INFLICTION

OF EMOTIONAL DISTRESSS
(As to Defendant Weiss)

293. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

294. Defendant’s conduct, in accessing Plaintiffs’ personal and private

information as outlined above, was intentional.

295. Defendant’s conduct was extreme and outrageous.

296. Defendant’s conduct was not for any proper purpose.

297. Defendant’s conduct caused severe emotional distress to Plaintiffs.

298. Plaintiffs suffered severe emotional distress and economic damage as a

result of Defendant’s intentional actions.

COUNT XIV – VIOLATION OF THE MICHIGAN IDENDITY THEFT

PROTECTION ACT – MCL 445.61 et. seq.

299. Plaintiffs restate and incorporate the allegations outlined above as if

fully set forth herein.

300. Plaintiffs’ personal social media content, videos, and other images were

stored electronically and were intended to remain private.

48
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.112 Filed 04/13/25 Page 49 of 52

301. Weiss unlawfully accessed this private and personal information.

302. His actions were unauthorized.

303. Defendants maintained a database of Plaintiffs’ sensitive information.

304. Defendants had a duty to notify Plaintiffs of the unauthorized breach of

their deeply private data.

305. Defendants, however, failed to do so.

306. As a result, Plaintiffs were completely unaware for years that their

highly sensitive, private data was being accessed without their authorization in

violation of Michigan’s Identity Theft Protection Act.

307. As a result of Defendants’ conduct, Plaintiffs have suffered severe

damages.

WHEREFORE, Plaintiffs respectfully request the Honorable Court to enter

judgment against Defendants in an amount that will fully and fairly compensate them

for their damages; for costs of this action; for pre- and post-judgment interest;

attorney fees; and for all other just and proper relief.

Respectfully submitted,

/s/ Jonathan R. Marko

Jonathan R. Marko (P72450)
MARKO LAW, PLLC
Attorneys for Plaintiff
220 W. Congress, 4th Floor
Detroit, Michigan 48226
P: (313) 777-7529 / F: (313) 771-5785
[email protected]

49
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.113 Filed 04/13/25 Page 50 of 52

/s/ Noah S. Hurwitz

Noah S. Hurwitz (P74063)
Hurwitz Law, PLLC
Attorneys for Plaintiff
340 Beakes Street, Suite 125
Ann Arbor, MI 48103
Dated: April 13, 2025

50
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.114 Filed 04/13/25 Page 51 of 52

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF MICHIGAN
SOUTHERN DIVISION

MCKENZIE JOHNSON, JANE DOE 1,

JANE DOE 2, JANE DOE 3,
JANE DOE 4, JANE DOE 5,
JANE DOE 6, JANE DOE 7,
JANE DOE 8, JANE DOE 9,
JANE DOE 10, JANE DOE 11,
JANE DOE 12, JANE DOE 13,
JANE DOE 14, JANE DOE 15,
JANE DOE 16, JANE DOE 17,
JANE DOE 18, JANE DOE 19,
JANE DOE 20, JANE DOE 21,
JANE DOE 22, JANE DOE 23,
JANE DOE 24, JANE DOE 25,
JANE DOE 26, JANE DOE 27,
JANE DOE 28, JANE DOE 29,
JANE DOE 30, JANE DOE 31,
JANE DOE 32, JANE DOE 33,
JANE DOE 34, JANE DOE 35,
JANE DOE 36, JANE DOE 37,
JANE DOE 38, JANE DOE 39,
JANE DOE 40, AND JANE DOE 41,
on behalf of themselves and others
similarly situated,

Plaintiffs, Case No. 25-10855

v. Hon. Mark A. Goldsmith

MATTHEW WEISS; the REGENTS

OF THE UNIVERSITY OF MICHIGAN;
the UNIVERSITY OF MICHIGAN;
KEFFER DEVELOPMENT SERVICES,
LLC,

Defendants.

51
Case 2:25-cv-10855-MAG-EAS ECF No. 14, PageID.115 Filed 04/13/25 Page 52 of 52

Jonathan R. Marko (P72450) Daniel B. Tukel (P34978)

MARKO LAW, PLLC BUTZEL LONG
Attorneys for Plaintiff Attorney for Defendant
220 W. Congress, 4th Floor 201 W. Big Beaver Road Suite 1200
Detroit, MI 48226 Troy, Michigan 48084
(313) 777-7529 (248) 258-1616
[email protected] [email protected]

Noah S. Hurwitz (P74063)

HURWITZ LAW PLLC
Attorneys for Plaintiff
340 Beakes St., Suite 125
Ann Arbor, MI 48104
(844) 487-9489
[email protected]

JURY DEMAND

Plaintiffs, by and through their attorneys, hereby demand a trial by jury of the

issues in the above-captioned case.

Respectfully submitted,

/s/ Jonathan R. Marko

Jonathan R. Marko (P72450)
MARKO LAW, PLLC
Attorneys for Plaintiff
220 W. Congress, 4th Floor
Detroit, Michigan 48226
P: (313) 777-7529 / F: (313) 771-5785
[email protected]

/s/ Noah S. Hurwitz

Noah S. Hurwitz (P74063)
Hurwitz Law, PLLC
Attorneys for Plaintiff
340 Beakes Street, Suite 125
Ann Arbor, MI 48103
Dated: April 13, 2025

52