There is a particular kind of violation that comes with a data breach notification letter. It arrives, sometimes weeks or months after the fact, and tells you that information you trusted an institution to protect has been exposed. Medical records. Financial data. Personal history you shared in confidence. And there is nothing you can do to take it back.
For University of Michigan student-athletes, that violation hit with unusual force. These were young people who handed over some of the most sensitive information a person can share, and the institution holding it failed them.
What Happened at the University of Michigan
In 2023, the University of Michigan disclosed a data breach that exposed sensitive personal information belonging to students, alumni, applicants, and others connected to the university, including student-athletes whose records contained far more than a name and email address.
The exposed data included Social Security numbers, financial account information, medical and health records, and other personally identifiable information. For student-athletes specifically, the depth of that exposure carried a weight that goes beyond what most data breach victims face.
The university's response followed the familiar institutional playbook:
- A public notification, delayed from the actual breach date
- An offer of free credit monitoring services
- Assurances that steps were being taken to improve security
- No meaningful acknowledgment of the specific harm caused to individuals
What Is a Data Breach and When Does It Become a Legal Violation?
The Difference Between a Breach and a Legally Actionable Violation
A data breach occurs when unauthorized parties gain access to protected personal information. A breach becomes a legal violation when an institution:
- Failed to implement reasonable security measures to protect the data it collected
- Delayed notifying affected individuals beyond what law requires
- Collected more data than was necessary for its stated purpose
- Failed to properly dispose of data it no longer needed
- Misrepresented its data security practices
The core legal concept is negligent data security: the idea that institutions which collect sensitive personal information have a duty to protect it. When they fail that duty and people are harmed, legal liability can follow.
The Laws That May Apply
Multiple legal frameworks can come into play in a university data breach involving student-athletes:
- FERPA (Family Educational Rights and Privacy Act): Protects the privacy of student education records
- HIPAA: May apply where health and medical records are involved
- Michigan Identity Theft Protection Act: Requires timely notification to Michigan residents following a breach of personal information and establishes standards for data security
- Michigan Consumer Protection Act: Can apply where institutional conduct amounts to unfair or deceptive practices
- FTC Act: Federal framework governing unfair or deceptive data security practices by institutions
The Real Harm Behind the Headlines
Financial Harm: Identity Theft and Fraud
Social Security numbers and financial account information in the wrong hands can produce consequences that take years to untangle. Identity theft, fraudulent account openings, damaged credit, and tax fraud are all documented outcomes of the kind of data exposed in the Michigan breach. The financial harm is real, measurable, and in some cases, devastating.
Medical Privacy: When Health Records Are Exposed
For student-athletes, exposed medical records carry a particular sting. An injury history, a mental health diagnosis, a surgical record, this is information that can affect professional draft evaluations, contract negotiations, and insurance eligibility. Once it is out, there is no retrieving it.
Emotional and Psychological Impact
The feeling of exposure is not abstract. Knowing that strangers may have access to your most private information, including medical history, financial situation, and personal identifying details, produces anxiety, distrust, and a loss of control that courts increasingly recognize as compensable harm.
Reputational and Professional Consequences
For athletes with professional aspirations, the exposure of medical or performance data can have direct consequences on how they are evaluated by scouts, teams, and sponsors. The reputational dimension of a data breach is real and often underestimated in settlement discussions.
"But I Got a Free Year of Credit Monitoring..." Why That Isn't Enough
Credit monitoring has become the institutional default response to data breaches, and it is worth being direct about what it actually does and does not do.
Credit monitoring watches for activity on your existing accounts and alerts you after something suspicious happens. It does not prevent identity theft. It does not compensate you for harm already suffered. It does not address exposed medical records, emotional distress, or reputational damage. And it does not hold anyone accountable for the failure that caused the breach in the first place.
What institutions are offering when they provide credit monitoring is a liability management tool dressed up as a remedy. It costs relatively little, generates goodwill, and, if accepted without legal counsel, may create the impression that the matter has been addressed.
What to Do If Your Data Was Compromised
Document Everything
Save every communication you receive about the breach, including notification letters, emails, offers of credit monitoring, and any follow-up correspondence. Note the date you received each communication and what it said.
Monitor and Freeze Your Credit
Contact all three major credit bureaus (Equifax, Experian, and TransUnion) to place a fraud alert or credit freeze on your accounts. A freeze is the stronger protection and prevents new accounts from being opened in your name without your authorization.
Preserve the Notification You Received
The breach notification letter itself is evidence. It identifies what data was exposed, when the breach occurred, and what the institution is offering in response. Do not discard it.
Do Not Assume the Institution Will Make It Right
Universities and large institutions have legal teams, PR departments, and crisis communications playbooks designed to manage breach fallout in the most cost-effective way possible. Their interests and your interests are not aligned. Do not assume that what they are offering reflects what you are entitled to.
Speak With a Data Breach Lawyer in Michigan
The legal landscape around data breach claims is evolving rapidly, and Michigan residents have meaningful protections worth understanding. A privacy law attorney in Detroit who handles data breach cases can help you assess whether you have a viable claim, what damages may be available, and how to proceed, at no cost for an initial consultation at Marko Law.
What a Data Breach Claim Can Actually Win
Types of Damages Available
Depending on the specific facts and legal theories involved, damages in a data breach case may include:
- Actual damages: Out-of-pocket losses from identity theft, fraud, or costs incurred in responding to the breach
- Statutory damages: Some Michigan and federal statutes provide for fixed damages per violation, which can be significant in cases with large numbers of affected individuals
- Emotional distress damages: Compensation for the psychological impact of having sensitive personal information exposed
- Punitive damages: Available where institutional conduct was particularly reckless or egregious
- Attorney's fees: Recoverable under certain statutes, which means legal representation may come at no out-of-pocket cost to the plaintiff
Class Action vs. Individual Claims
Data breaches affecting large numbers of people are frequently litigated as class actions, consolidated cases where affected individuals are represented collectively. Class actions can be powerful tools for producing institutional accountability and systemic change. Individual claims may be appropriate where a specific plaintiff suffered documented harm that goes beyond the average class member's experience.
Your Data Is Part of Who You Are
Privacy is not a technical concept. It is the boundary between what you choose to share and what is taken from you without consent. When an institution collects your medical history, your financial information, your personal identifying details, and then fails to protect them, that is not a system error. It is a failure of responsibility that has real consequences for real people.
Michigan residents have legal rights in these situations. Those rights exist because lawmakers recognized that the harm from a data breach is genuine, that institutions have a duty to do better, and that accountability requires more than a notification letter and a year of credit monitoring.
If your information was exposed, what happened to you was not acceptable, and it was not your fault.
If Your Data Was Exposed, Marko Law Is Listening
Data breach cases move on tight timelines, and the decisions you make in the weeks following a notification can significantly affect your options. If you received a breach notification from the University of Michigan or any other institution, Marko Law can help you understand what your information may actually be worth, and what holding the responsible party accountable looks like in practice.
Contact Marko Law today for a free case evaluation.
π +1-313-777-7777
π 220 W. Congress, 4th Floor, Detroit, MI 48226
π markolaw.com
At Marko Law, we fight hard and we don't back down.
