Westmont College is a Christian, 1,200-student liberal arts school tucked into the idyllic foothills overlooking Santa Barbara, California. Its 15 sports teams compete in Division II of the NCAA.
It is, literally, geographically and athletically, thousands of miles from the University of Michigan, with its 50,000-plus student body, 100,000-plus football stadium and bustling downtown Ann Arbor campus.
So when the FBI arrived at Westmont a few years back and said they were investigating suspicious logins of university email accounts belonging to students and alumni, Jason Tavarez, the university's director of institutional resilience, initially worried there had been an internal security failure or an IT problem.
With the FBI offering scant detail, there was no reason to imagine this might somehow involve a coach from the iconic Michigan Wolverines football program.
And yet there on Monday, at the federal courthouse in downtown Detroit, was Matt Weiss, a former U-M and Baltimore Ravens assistant coach, pleading not guilty to 24 counts of unauthorized access to computers and aggravated identity theft. Weiss' attorney declined comment to ESPN following the arraignment.
The charges, prosecutors say, stem from a vast, extensive, nearly decade-long effort to gain access to the social media, email and iCloud accounts belonging to thousands of mostly female college athletes in order to download "personal, intimate photographs that were not publicly shared."
That included, the feds charge, at least five women who competed for the Westmont Warriors.
"Absolutely shocking," Tavarez said. "When I read the indictment, I couldn't believe it."
The Weiss news has left much of college athletics both shocked and concerned about where else and whom else Weiss might have victimized.
Prosecutors say the number is approximately 3,300 athletes but have offered no specifics on individuals and schools outside of what's in the 14-page indictment.
"This is really prolific," said Carrie Goldberg of New York's C.A. Goldberg Law Firm, which specializes in cases of sexual privacy and victim rights, mostly involving cyber crimes.
"It is not a ton of victims for someone overseas running a hacking ring," Goldberg said. "But in terms of a single individual not trying to financially profit, this is the most prolific example I've seen."
Observers say they're struggling to believe it -- both that an otherwise successful football coach, married father of three and Vanderbilt grad would do what Weiss is accused of doing, let alone how he could have managed to pull it off.
Michigan fired Weiss as its co-offensive coordinator in January 2023 after the school uncovered "inappropriately accessed" computer accounts inside of its football facility, Schembechler Hall. He was earning $850,000 a year coaching a Big Ten championship team. Weiss, now 42, had previously worked a dozen years with the Ravens of the NFL.
He is alleged to have spent excessive time and energy finding ways to hack into the accounts of young women, apparently for his own personal use. He is not charged with publishing, selling or sharing what he found, nor extorting the victims for money, as is more common in these kinds of cases.
His initial entry point, according to his indictment, was gaining heightened access to data via the Keffer Development Services, a third-party contractor that keeps the medical information for some 150,000 athletes at approximately 100 schools, including Westmont. Keffer declined comment to ESPN on the situation.
From there, prosecutors charge, he decrypted Keffer's code and then used open sources to gain personal information, allowing him to guess or reset individual passwords. His victims, the feds allege, were not random. He kept notes on "their school affiliation, athletic history, and physical characteristics" and later, if he found photos or videos, on "their bodies and their sexual preferences," per his indictment.
How the small-college athletes of Westmont could've gotten on his radar is unknown.
If convicted, Weiss faces dozens of years in prison and millions in fines for actions that prosecutors allege ran from 2015, when he worked for the Ravens, until his 2023 Michigan firing. It is but part of the potential legal fallout from this case, one that could expand throughout college athletics.
Two female former Michigan athletes -- a gymnast and a soccer player -- have already filed a class action suit against Weiss, the university, its board of regents and Keffer Development Services over the alleged breach.
"This negligence has compromised the confidentiality of personal, medical, and intimate information leading to profound feelings of betrayal, trauma, and fear among former female student-athletes and others affected," lawyer Parker Stinar, of Chicago's Stinar Gould Grieco & Hensley said.
In 2022, Stinar won a $490 million settlement with Michigan for over 1,000 football players who alleged they had been sexually abused by former football team doctor Robert Anderson. He's taking particular exception to Michigan's lack of oversight of Weiss' computer activity.
"We are committed to holding the University accountable for its actions and to ensuring that such failures do not happen again," Stinar said.
Michigan director of public affairs Kay Jarvis said the university has yet to be served with the complaint and can't comment on pending litigation. Keffer also declined to comment to ESPN on the lawsuit and overall situation.
The former Michigan athletes are expected to be the first of many complainants in potentially many lawsuits against other schools. How much exposure a university faces due, in part, to the failures of a third party vendor will be a major part of any case and likely determined by indemnity clauses in contracts, lawyers told ESPN. Tavarez, of Westmont, said the FBI told him they considered the school to be a victim of Weiss.
The unusual nature of Weiss' alleged use of the photos is also of interest. Cases of sextortion and revenge porn have risen through the years but most laws, Goldberg noted, are based on a perpetrator using the material to seek money or cause distress and embarrassment to the victim. The perpetrators are often international scammers or ex-romantic partners. Other laws of this nature "require a publishing element," Goldberg noted.
None of that is outlined in the indictment, which is the only information the FBI and the United States attorney's office has publicly shared. If the government's narrative is correct, Weiss didn't personally know his victims and was covertly collecting a trove of specific images for his own use.
"His vice apparently was his victims not consenting to be sexual entertainment," Goldberg said.
The indictment states that Weiss' crimes include violations of "state torts of Invasion of Privacy" in Michigan, Maryland and Pennsylvania. A separate charge includes California. Legal experts believe the indictment only mentions the states related to the 24 counts that are centered on just 10 Jane Does. It is possible, if not likely, victims will come from many other locations.
After all, if Weiss was hunting for potential victims, as the indictment alleges, at little Westmont, then state borders, school size or anything else hardly mattered.
"When I was talking to the FBI, they said that it was not just us and not just a couple of schools," Tavarez of Westmont told ESPN.
Tavarez said the FBI contacted the victims associated with Westmont and the school added that "any information utilized in this investigation was done so with the consent of the victims named in this indictment."
Both Stinar and Goldberg said that it is imperative that every victim is contacted either by law enforcement or the schools once they become aware of a breach. Meanwhile, Westmont said it has continued its always ongoing efforts to secure the accounts of its students and alumni.
"It's heartbreaking," Tavarez said. "We are very sensitive to people's information and how we store it and what we use it for, so obviously you are always worried about hackers ... I really feel for the victims."
Exactly how many there might be, and what schools they competed for, is still to be determined.