What Happened: Inside the U of M Data Breach

When the University of Michigan data breach first made headlines, the details were murky. At first, the university downplayed the situation—calling it a “technical issue” and assuring students that IT teams were “working to resolve it.” But as weeks turned into months, and federal investigators became involved, the truth began to surface.

This wasn’t a random cyberattack. It was a preventable internal failure—one that’s now linked to a shocking figure within the university itself.

The Timeline

• January 2023: University IT officials discovered suspicious activity on university email accounts. Shortly after, reports emerged that Matt Weiss, then the co-offensive coordinator for Michigan Football, was being investigated for “unauthorized computer access.”
• Early 2023: Weiss was placed on leave and later fired. The University initially described the situation as “isolated,” but internal communications obtained through Freedom of Information Act (FOIA) requests suggested broader system vulnerabilities.
• Mid–2023: The University of Michigan confirmed that an “unauthorized third party” had gained access to confidential university data, forcing them to shut down parts of their online network.
• 2024: Federal prosecutors formally charged Weiss with multiple counts of unauthorized access and identity theft, alleging he improperly accessed protected digital systems—raising new questions about how deep the breach really went and how long it had been happening.

Who Was Involved

At the center of this breach is Matt Weiss, a once-prominent football coach who now faces serious federal charges related to digital misconduct and identity theft. The FBI and U.S. Department of Justice are investigating whether Weiss—or others with internal access—used university networks to access or misuse student and staff data.

The University maintains that the breach was “contained,” but court documents and internal records suggest otherwise. Investigators believe the network’s exposure may have gone far beyond Weiss’s accounts, leaving thousands of students, faculty, and alumni vulnerable.

What Data Was Compromised

Based on university notices, student statements, and FOIA-released communications, the stolen or accessed data may have included:

• Full names and U-M email addresses
• Student ID numbers and login credentials
• Social Security numbers and financial aid information
• Health and athletic records for student-athletes, trainers, and staff
• Internal communications and academic files

While U of M has notified some affected individuals, many students still don’t know what personal information of theirs was exposed.

This lack of transparency has left students and families anxious—and rightly so. For those who trusted the university with their most sensitive information, “We’re investigating” isn’t good enough.

What U of M Said vs. What the Records Show

Publicly, U of M has insisted that it “responded swiftly” and “followed all data protection protocols.” But internal documents obtained through FOIA tell another story—delayed response times, incomplete system monitoring, and inadequate communication with affected parties.

Emails between administrators suggest that officials debated how much to tell the public and when to release statements, worried about reputational harm to the university. Meanwhile, thousands of students were left in the dark about whether their personal data had already been stolen.

What Students Should Do Right Now

If you’re a University of Michigan student, athlete, or alumni and you’ve been notified—or even suspect—that your personal data may have been compromised, you can’t afford to wait. Every day that passes gives cybercriminals more time to use your information for identity theft or fraud.

Check If You Were Affected

Start by confirming whether your information was involved in the U of M data breach.

• Visit the university’s official data breach notification site or contact U of M’s Information Assurance (IA) or ITS Security departments.
• Ask directly: “Was my data part of the recent breach, and what specific information was accessed?”
• Keep a record of who you spoke with, the date, and what was said.

If you received an official breach notice from the University—save it. That letter could become important evidence in your case.

Secure Your Accounts Immediately

Once data is exposed, account security should be your first priority.

• Change your passwords on all U of M accounts and any others that use the same login credentials.
• Enable multi-factor authentication (MFA) wherever possible—it’s one of the best defenses against unauthorized access.
• Check your login history on U of M portals and email to see if there were any suspicious sign-ins.
• Avoid clicking links or opening attachments from unknown senders—phishing scams often spike after data breaches.

Monitor Your Credit and Financial Accounts

Your personal data is more than an email address—it’s a key that can unlock your financial life.

• Request free annual credit reports from all three major bureaus at AnnualCreditReport.com.
• Look for new accounts, loans, or inquiries you don’t recognize.
  
  
• Consider placing a temporary credit freeze or fraud alert on your credit file to block unauthorized activity.
• Review your bank statements, Venmo, PayPal, and student loan accounts for suspicious transactions.

If you see anything unusual, report it immediately to your financial institution and the credit bureaus.

Report Suspicious or Fraudulent Activity

If you believe your identity has been stolen or your data is being misused:

• File a report with the Federal Trade Commission (FTC) at IdentityTheft.gov.
• Contact the Michigan Attorney General’s Office to report the breach and potential fraud.
• Notify local law enforcement if significant theft or fraud has occurred.

These reports help create a paper trail that can be vital in recovering losses—and in proving harm for potential legal action.

Document Everything

Keep a detailed record of everything related to the breach:

• Save all emails, letters, or text messages from the University of Michigan about the breach.
• Keep notes of phone calls with U of M officials, banks, or investigators (include names, titles, and dates).
• Store receipts and costs for things like credit monitoring, fraud alerts, or lost work hours spent dealing with the issue.

These documents may support your legal claim for damages later on.

Contact an Attorney

If your Social Security number, financial aid, or health data was compromised, you may have a claim under Michigan and federal law.

A qualified data breach attorney can help you:

• Determine whether U of M violated its legal duty to protect your data.
• File claims for identity theft risk, emotional distress, or negligence.
• Join or initiate a class action lawsuit if appropriate.
• Ensure your case is handled before critical legal deadlines expire.

The University of Michigan has a team of lawyers protecting its interests—you deserve someone protecting yours.

At Marko Law, our firm is actively investigating the U of M data breach and representing students, staff, and alumni affected by it. We’ve gone up against U of M before—and we’re doing it again to ensure students get the truth, protection, and compensation they deserve.

You Deserve to Be Protected

This wasn’t just a technical glitch. It was a preventable failure—a breakdown of duty, trust, and accountability that put thousands of students, athletes, faculty, and alumni at risk. The University of Michigan data breach didn’t happen in a vacuum. It happened because people who were supposed to protect you didn’t.

When powerful institutions mishandle personal data, they often hope the story will fade away—that students will move on, that victims will stay quiet. But silence only protects those who failed, not those who were harmed.

You have the right to know what happened. You have the right to demand transparency. And you have the right to be made whole.

If your data was exposed in the U of M breach, now is the time to act—not months from now, not when the damage is already done. Take steps to protect your information, monitor your accounts, and hold those responsible accountable.

At Marko Law, we’re leading the fight for the students and families impacted by this breach. We’ve stood up to U of M before—and we’re doing it again. Because no Michigan student should have to wonder if their university values reputation over responsibility.

Contact Marko Law for a Free Case Evaluation

📞 Phone: +1-313-777-7777
📍 Office: 220 W. Congress, 4th Floor, Detroit, MI 48226
🌐 Website: www.markolaw.com‍