Former NC college cheerleader sues school amid hacking case with ex-Michigan coach
High Point University has been named as a defendant in a civil lawsuit related to the hacking and privacy breach case against former Michigan football assistant coach Matthew Weiss.
Two women are suing Weiss, Keffer Development Services and High Point in a civil lawsuit, claiming Weiss’ alleged actions were made possible because of “institutional negligence.” The U.S. Department of Justice is handling criminal charges.
“This action is brought to hold the defendants accountable for failing to protect their students from foreseeable harm,” the lawsuit states.
One of the plaintiffs attended High Point University, based in High Point, North Carolina, from 2006-10 and was a member of the cheerleading team. The second plaintiff attended High Point from 2011-16.
Megan Bonanni and Lisa Esser-Weidenfeller are two attorneys representing the unnamed individuals. Bonanni previously told the News & Observer the purpose of the lawsuits is to create change. The legal team believes the security of the university systems and Keffer Development’s systems were inadequate to protect the private data with which they were trusted.
The lawsuit states Keffer Development’s platforms did not require two-factor authentication nor did it have the proper auditing program to monitor activity. Had that been in place, the company could have detected the years-long scheme.
High Point University did not take reasonable action to protect its students, the lawsuit alleges.
“Both Keffer and defendant High Point University had a responsibility and duty to protect the private data of students and student athletes stored within their databases and to have mechanisms in place to prevent such a gross invasion of privacy as what occurred in this case,” the lawsuit states. It called the efforts to prevent, detect and mitigate cyber threats substandard.
“This prolific and egregious breach and violation was entirely preventable by the university and Keffer,” the lawsuit added.
The News & Observer has contacted High Point for comment.
Ex-Michigan coach Matt Weiss indicted
Weiss was indicted by a grand jury in March on 14 counts of unauthorized access and 10 counts of aggravated identity theft after federal investigators obtained thousands of photos and videos.
The subjects were often nude or engaged in sexually explicit acts. Weiss allegedly made an effort to search for and download the images and videos after hacking into more than 100 databases with student-athlete information, including HIPAA-protected medical data. Keffer maintained the databases.
From there, Weiss allegedly downloaded passwords and data that he used to hack into personal social media, email and cloud storage accounts. He also hacked into school-specific databases for the same purpose, the DOJ claims.
More than 150,000 people were affected by the hacks; most but not all were student-athletes. He specifically targeted more than 2,000 individuals to seek private photos and videos, the indictment states. Bonanni said there are victims who do not know they were impacted.
Bonanni and Esser-Weidenfeller both represent survivors of sexual violence. They represented survivors of former gymnastics team doctor Larry Nassar and Dr. Robert Anderson, the late physician who allegedly sexually abused more than 1,000 people in his nearly 40 years working at the University of Michigan, in civil lawsuits.
Litigation could take years because of the widespread nature of the case.
Bonanni called Weiss’ alleged actions “cyber sexual assault” and said the effort necessary to carry out such a scheme “reveals a deeply predatory mindset.”
“It may not involve physical contact, but the emotional and psychological impact is devastating,” Bonanni said. “The harm comes from the same place: a desire to exert power by violating another person’s dignity and autonomy. This case is a wake-up call for universities across the country. It shows how digital tools can be weaponized, especially against young people, and how important it is that institutions take proactive steps to prevent this kind of abuse and hold those responsible fully accountable.”
This story was originally published April 23, 2025 at 3:01 PM.
