- HISA alleges Marshall Gramm took confidential horse health data from its portal from early May to mid-June.
- The Authority is seeking restitution of proceeds from his wagering, handicapping contests and horse claims in that window.
- Sanctions under HISA’s Rule 8200 range from censure to a lifetime ban from registration with the Authority.
- Gramm says he used his own credentials, bypassed no safeguards and will defend himself against the charges.
LEXINGTON, Ky. – The Horseracing Integrity and Safety Authority announced Aug. 17 that it had charged Marshall Gramm with rule violations relating to fraud and unauthorized access of confidential horse health records. The Authority alleges he pulled veterinary data from the HISA Portal over six weeks in which he wagered, entered handicapping contests and claimed horses.
What HISA Says It Found
HISA opened an investigation in June after past performance reports for the horses Deterministic and Griffin’s Wharf, which carried confidential health data, were posted on social media by someone unconnected to those horses. The Authority said its preliminary review found no system breach by anyone lacking prior authorization to reach the portal, and it extended the inquiry to look for vulnerabilities that would let an authorized user view and share the records.
HISA employees and contractors ran interviews, and the Authority separately commissioned the cybersecurity firm Arete for a third-party forensic review. Every strand of that work led to Gramm alone, HISA said, both for reaching the health records and for turning them into past performance reports on horses he had nothing to do with.
According to the Authority, Gramm built a program that pulled the data at scale “in a manner designed to mimic authorized activity to avoid detection by HISA’s security systems.” HISA said Gramm admitted he was the source of the two reports that circulated in June when investigators confronted him with the findings.
The Authority also said that during the same window he entered handicapping contests, wagered into pari-mutuel pools and claimed several covered horses across multiple jurisdictions and racetracks.
“There must be significant consequences for individuals who violate the integrity of our rules and obtain and abuse confidential horse health information,” HISA CEO Lisa Lazarus said in the announcement.
What The Portal Holds And Who Can See It
The HISA Portal carries the veterinary treatment records that attending veterinarians must report under the Authority’s Racetrack Safety rules, the Rule 2200 Series, covering treatments, procedures and surgeries performed on covered horses. HISA said that information should reach only a horse’s connections and regulatory veterinarians.
Nothing in the announcement describes a hacked system or a stolen password, and HISA said no unauthorized party breached the portal. The allegation is that a registered user with legitimate credentials reached records that were not his to read, and did it at volume.
Why HISA Wants The Wagering Proceeds Back
The Authority said it intends to recover whatever Gramm made from the contests, the wagers and the claims inside that six-week window. It named his fellow contest entrants and the wagering public among the parties harmed.
Pari-mutuel pools are the settlement mechanism for legal horse betting in the United States, and they are zero-sum among the bettors in them. The track’s takeout comes off the top and what remains is divided among winning tickets, so an edge one bettor holds is paid for by the other bettors in the pool rather than by a bookmaker. Handicapping contests distribute entry fees the same way.
Veterinary information the rest of the market cannot see is the kind of edge that moves a claiming decision or a price, which is why the restitution HISA is seeking runs to contest and wagering proceeds rather than to a fine alone.
Gramm’s Defense
Gramm said in a statement posted to X that HISA “has unfortunately decided to pursue disciplinary proceedings against me regarding data I accessed through the HISA Portal,” and that he had made a good-faith effort to resolve the matter before charges were filed. He said the two sides came close but could not agree on several issues, including his ability to speak publicly about the case.
“I used my own account and credentials and never attempted to conceal my identity or circumvent HISA’s security,” Gramm said, adding that once logged in he “bypassed no security protocols or other safeguards to access the information.” He described himself as a college professor and data analyst, and said the dataset was large enough that he had not fully reviewed its contents or understood its scope at the time he accessed it.
Where he exercised poor judgment, Gramm said, was in not bringing the vulnerability to HISA’s attention sooner after the leak became a public story. He said he intends to defend himself against the charges.
Sanctions And The Path To A Hearing
The announcement does not identify which provisions the Authority charged. HISA’s enforcement rules carry a single fraud provision: Rule 8100(h) makes it a violation to perpetrate or attempt to perpetrate a fraud or misrepresentation in connection with the care or racing of a covered horse.
Rule 8200 sets the sanctions available for violations of the act and of the Authority’s rules, apart from anti-doping cases and state racing rules, and the schedule is wide.
It runs from censure and a cease-and-desist order, through fines of up to $50,000 for a first violation and up to $100,000 for a violation that poses an actual or potential threat to the integrity of covered horseraces, to denial or suspension of registration, revocation subject to reapplication at a specified date, and a lifetime ban from registration with the Authority. Any sanction must be imposed in proportion to the nature, chronicity and severity of the violation.
Under Rule 8330, HISA’s board may refer an alleged Rule 8100 violation to one or more members of its Internal Adjudication Panel, to an arbitral body, or to state stewards, or hear the matter itself before a panel of three board members under Rule 8340. A covered person is entitled to at least 20 days’ notice of a hearing’s time, place and legal basis, and of the rules alleged to have been violated.
Rule 8350 allows an appeal to the board, and the Federal Trade Commission reviews any final civil sanction. The commission approves HISA’s rules under the Horseracing Integrity and Safety Act of 2020, a federal structure that sits outside the state-by-state regulators licensing legal sports betting.
HISA said it will share what its investigations collected with federal and local law enforcement, state racing commissions and other relevant authorities so they can consider actions outside its own remit. The Authority said it will also pursue further remedies and claims arising from harm to horse owners, trainers and veterinarians who rely on the portal’s confidentiality, and that it has already changed its technology systems to prevent similar unauthorized access.
