In June 2026, the thoroughbred world was sent spinning when confidential veterinary health data leaked onto social media, displayed within augmented past-performances posted by a horse racing social media rabble rouser. It took weeks of frantic whispers, preliminary denials, and a digital manhunt before the story finally broke wide open: the source of the leak wasn’t an organized crime syndicate or a disgruntled groom, but Dr. Marshall Gramm, a Rhodes College economics professor, founding partner of Ten Strike Racing, and a ubiquitous figure across handicapping contests, claiming ranks, and industry governance committees. Gramm wasn’t just a casual observer; he was a horse owner, bettor, and had a media profile, an “insider” who had spent years analyzing racing information and participating in the very types of high-level industry circles where data privacy and oversight were hammered out.

For weeks after those custom past-performances for Deterministic and Griffin’s Wharf surfaced on X, posted by Justin Wunderler, who then started pulling the thread, HISA’s public line was that nothing had gone wrong on its end. On June 15, CEO Lisa Lazarus said flatly that the data “could not have come from the HISA portal.” It had. Reconstructing what happened took roughly two months of digital forensics, contractor interviews, and a third-party cyber investigation by the firm Arete. On August 17, 2026, HISA filed two disciplinary charges against Gramm, one under the rule governing access to veterinary records and one for fraud.

What tips this from a data-policy case into something stranger is a single scene. On the morning of July 17, Gramm joined an hour-long call convened by The Jockey Club, to which he had been elected in 2024. The subject was the leaked past-performances and whether the industry should start disclosing veterinary records to the public. On the call with him were Lazarus, Patrick Cummings of Mike Repole’s National Thoroughbred Alliance, and Jockey Club executives Jim Gagliano and Charlotte Clément. Gramm offered ideas. He did not mention that he was the reason the meeting was happening. Around 5 p.m. that same day, HISA investigators confronted him, and he acknowledged being the source. Lazarus already knew where the trail led while she sat on the morning call. Nobody else on the call did. A man was helping the industry craft its response to his own leak.

Fraud on the Market

Lazarus reached for a specific analogy. “The way we really characterize this and understand it is fraud on the market, like insider trading,” she said. “He had access to information that nobody else did. He was able to use that information to monetize it.”

The monetizing runs through the claiming box. In a claiming race, any licensed owner can buy a horse for a fixed price, and the commitment is made before the race is run, with no knowledge of what the horse’s connections know about its soundness. That blindness is what keeps the game fair. Give one buyer secret access to the veterinary records for the horses in the race and the blindness is gone. He knows which ones are sound and which are patched together, and he claims accordingly. HISA says that is what happened. Gramm accessed confidential health information on each of the nine horses he claimed between May 9 and June 30, claims that by the Paulick Report’s tally of the charts totaled $210,500 and have since produced $80,455 in purse money. HISA plans to reimburse the horses’ previous owners for those earnings and recover the money from Gramm.

That harm is what broadens this past a technical curiosity, because Gramm touches most of the constituencies the sport has. He owns horses and runs them through the claiming ranks. He is one of the best-known tournament players in the country, the 2020 Breeders’ Cup Betting Challenge champion, and this year he finished second in NYRA’s Belmont Stakes day contest for a $35,250 cash prize and a seat back into that same Challenge, on top of qualifying for the 2027 National Handicapping Championship. And he sits inside The Jockey Club, part of the governance structure the sport built to police this kind of thing. The industry spent years consolidating authority into one national body on the argument that a single regulator with teeth and modern technology would protect the sport better than the old patchwork of state commissions. When the breach traces to a trusted member of that structure, it becomes a question about the structure itself: whether the people handed the keys can be trusted to keep track of them. HISA is now seeking sanctions up to a lifetime ban and says it will share its findings with racing commissions, wagering entities, and federal law enforcement, including the FBI.

How the Data Actually Got Out

Two accounts of how Gramm got the data have circulated, and both mislead. Gramm says he did nothing exotic. The information “was available through my authorized HISA account,” he wrote on X, and his real lapse was failing to report how much was exposed. HISA describes something more deliberate. Lazarus said Gramm had legitimate credentials for the 75-plus horses tied to Ten Strike Racing but “used an automated internet browser and wrote computer code to obtain records for horses he was not authorized to view,” pulling “millions of records” in batches of 500 or fewer, a size HISA believes was chosen to stay under the threshold that would trigger a security alert.

Most of the coverage stops at that standoff and misses where the failure actually sits. Nobody claims Gramm forged a login or cracked a password, so authentication was never the problem. The system knew who he was. What it never did was check whether the person logged in had any right to the specific record he requested. That check, called object-level authorization, is the one that was missing. Michael Novak, who wrote the sharpest technical breakdown of the incident, put it in one sentence: “The portal never checked whether you should see what you asked for.”

Once you see the gap, the sophistication drains out of the story. If records are addressed by sequential IDs, horse/1, horse/2, horse/3, then an automated method “at scale” is a loop that counts, and “millions of records” measures how little stood in the way rather than how clever the method was. Novak’s fixes are the stuff of a first-week code review: stop using sequential numbers as identifiers, add rate limiting so one account cannot drain the database in an afternoon, and tie every record to the account allowed to see it. The batching that HISA offers as proof of intent points the same way, because throttling requests to duck an alarm only matters when the alarm is the one thing standing between a logged-in user and the whole database. Even the tooling framed as evidence of a plot, a scripted headless browser, is what every web team uses to test its own site. Novak’s line on that: “Using a testing tool is not hacking.”

HISA rejects this framing head-on. Lazarus has called the social-media theory that the portal was easily breached “patently false,” and waved off the idea that Gramm could tweak a web address and stumble onto strangers’ horses. By her account he ran “an automated and invisible browser” to pull records at scale while hiding the activity. She is right about the effort. Gramm did not fall on his keyboard. But that answers a charge the authorization argument never made. A deliberate scraper and an unprotected record describe two different things: the tool, and the hole it walked through. Whether the identifiers were literally sequential, which is Novak’s illustration rather than a confirmed detail, or simply reachable once you were logged in, the server still failed to ask the one question that mattered, whether this account should see this record. A clever method does not make up for a missing authorization check. It only describes how thoroughly the missing check got used.

Gramm’s own defense lands on the same spot. He calls it “an access-control vulnerability” and argues that “making me the focus of this matter is a distraction from the fundamental issues HISA needs to address with its systems.” On the architecture, he is right, which is the uncomfortable part. On his own innocence, I am not convinced. His other line, that he “had not fully reviewed” the data’s contents or “understood the scope of the information it contained,” is very hard to square with the method HISA describes. Writing code to page through a database 500 records at a time, under a limit, is not the behavior of someone who has no idea what he is looking at. A quantitative economist who builds an automated scraper grasps a scope problem better than almost anyone. The vulnerability was HISA’s to fix. Claiming he never realized how much was in there is a separate assertion, and a far less believable one.

HISA now says the hole is closed and that it is “confident Gramm was the only person involved.” That confidence deserves scrutiny. The same investigation needed an outside forensics firm and the better part of two months to reconstruct what one insider did. A system that could not see the access while it was happening, in Novak’s words “they clearly were not alerted to the fact that these records were accessed at all,” cannot prove a negative about everyone else who ever held a login. There was no camera, so there is no tape to review.

The Sophistication Gap

None of this comes from HISA being a low-tech operation. The opposite is true, and that is what makes it strange. HISA partnered with Palantir to build AI tools that mine medical and performance data for horses at elevated risk of breaking down. Its 2024 books carry an unbudgeted $1.2 million Palantir line and a growing bill from Amazon Web Services. The tools have names and a track record: HISA CHECK√, which reads the medical database and entry history to flag at-risk horses, and HISA Horse In-Sight, which gives regulatory veterinarians a full view of a horse’s health and performance. That is real work on a real problem, and it points almost entirely at the horse.

The bettor-facing portal came from a different tier of the operation. HISA employs a chief technology officer, Steve Keech, and builds through a rotating set of small outside contractors. Its own 2024 financial report names the technology vendors: Amazon Web Services, KoderShop and T-Soft Consulting of Toronto, XORGate of Burlington, Ontario, Innovative Data Processing of New York, and others. The end-user portal is credited to KoderShop on the vendor-review site Clutch, in a review left by Keech himself, who rated the work 4.5 out of 5.

The most revealing line in this whole story sits inside that positive review. Rating the project schedule, Keech wrote: “In the begining the lack of specific horse racing knowledge slowed down some aspects of the project.” I do not quote it to embarrass anyone. Plenty of strong engineers have never handicapped a race, and the review is a compliment. I quote it because it names the fault line. When the people building the plumbing do not know the domain, they cannot see what carries weight. A claiming horse’s vet history is the most valuable piece of non-public information in the building, the thing a sharp bettor would pay to see before a race, and it needed to be treated that way. You harden what you understand to be valuable and you leave the rest exposed. HISA even markets the arrangement as a virtue: its 2026 budget boasts that the software was “procured internationally from development resources in the US, Europe, and Asia,” enabling “a 24-hour code and test development cycle,” which it calls “the most cost-effective method of building and maintaining technology systems/portals.” Knowing the data is half of building anything worthwhile on top of it. After years spent inside this kind of racing data, I have come to think the two cannot be separated. The design was still HISA’s to own, and the review that should have caught the hole was HISA’s to run.

The spend behind all of it is hard to see even for the people paying for it. When the 2027 budget opened for public comment, Jon Stettin, who runs the handicapping site Past The Wire, asked HISA the question its filings never answer: “How much is budgeted individually for Palantir, Amazon Web Services and every other technology vendor expected to receive more than $100,000 during 2027?” HISA reports the whole cloud-and-software bill as one line. A horseplayer has to file a federal comment to ask what any single vendor actually delivers.

Following the Money

The budget is the context that makes all of this sting. HISA came out of nothing. Audited expenses ran $2.7 million in 2021, $12.9 million in 2022, then $39.1 million in 2023, $52.4 million in 2024, and $57.7 million in 2025. The proposed budgets, which set what the industry is assessed, have run higher, above $80 million at the 2025 peak before easing to about $73 million assessed for 2027. HISA raises that money with a per-start fee: an assessment that tracks and horsemen owe for every horse that goes to the gate. The fee has moved the opposite way from the budget, from roughly $285 a start in 2023 to $449.97 for 2027, a compound annual growth rate near 12 percent by Churchill Downs’s reckoning. The topline can fall while the per-start fee rises because the number of starts keeps shrinking, so the same cost lands on fewer horses. It costs more to run a horse under HISA every year, and the tracks and horsemen owe the difference. The balance sheet stays thin to the point of fragility. HISA has closed four of its five years with negative net assets, ending 2025 in a deficit of roughly $310,000, and it writes off about a million dollars a year in assessments the industry never pays. In 2025 it had to restate the prior year to correct understated interest, an error its auditors flagged as a “significant deficiency,” and the correction turned a reported 2024 surplus into a deficit.

The people funding it are losing patience. Eric Hamelback, who runs the National HBPA, told the FTC that the industry has “funded well over $250 million in HISA operations,” and questioned whether “the massive, cumulative investment has produced measurable safety and integrity improvements commensurate with those costs.” His own answer: “Unfortunately, it hasn’t.” He added that HISA “enjoys the benefit of a government-mandated, guaranteed revenue stream while remaining free from the transparency, accountability, and oversight requirements that apply to public agencies.”

Technology is a growing slice of that spending, up from about $6.1 million in 2023 to $10.7 million in 2025, and the security-relevant part of it arrived late. HISA added cyber insurance only in 2025, a $2 million policy, and that policy, rather than HISA’s own budget, ended up covering Arete’s forensic bill on the Gramm investigation. The legal spending is heavier and more revealing. HISA runs a dedicated “Legal, Lawsuits” line that paid out $1.5 million in 2024 and $2.9 million in 2025, money spent defending the Act’s constitutionality against a docket that reached fourteen active cases. Its own reports name the drag plainly: the litigation “has greatly diverted the Authority’s resources… and generally undermined medium- and long-term planning.”

That pressure is the engine behind HISA’s next move, and it is where the Gramm case turns strange. HISA has committed to raising half its revenue from outside the assessments by 2030 and to weaning off them entirely by 2035. One of the two pillars of that plan, alongside a proposed federal visa program, is commercializing its data. Lazarus has described working “with an insurance broker to build a model for equine insurers” off HISA’s archive of more than seven million veterinary records. So the same veterinary data is a confidential health record when Gramm reaches it and a revenue stream when HISA packages it. The two are not identical acts. HISA is talking about anonymized, aggregated data sold under contract, not one insider scraping named horses. But the incident raises a question the plan has not answered. If this data is valuable enough to build a business on, it was valuable enough to secure first, and selling it will stand up a fresh market with its own insiders and its own asymmetries. The horsemen paying for the plan are not sold on it. The New York Thoroughbred Horsemen’s Association told the FTC it had “been told that there is an expectation that the HISA assessment will drop 50% by 2030, but we have not yet seen any significant reduction in our costs,” and asked the Commission to require a detailed cost-reduction plan: “What are the new revenue streams, how much are they expected to raise, and when will they be implemented?” All of it rides on a legal foundation that is still contested. As Lazarus put it, the courts will soon decide whether “we’re all in or all out.”

How Overblown Is This?

There is a reading where this is overblown. Racing has always run on information asymmetry. The craft is the search for an edge the rest of the crowd lacks, a bias read, a workout nobody clocked, a trainer pattern. One person’s clever data-driven angle is another person’s cheating, and that line has always been argued. You could tell yourself Gramm just found a sharper edge than everyone else.

Cheating in racing has never had one agreed meaning. At one end is conduct nobody defends: doping a horse, or the 2002 Breeders’ Cup Pick Six fraud, when a programmer inside the tote company altered a bettor’s picks after the early legs had run and came within an impossibly perfect ticket of a multimillion-dollar payout. At the other end are the betting coups the sport half-admires, gamblers who back horses the public has written off, get a price, and collect. In between sits computer-assisted wagering, entirely legal, where high-volume teams take rebates the ordinary bettor never sees and fire their money in the final seconds, moving the odds after everyone else has committed. The line running through all of it is blurry and contested, and plenty of players already suspect the pools tilt toward whoever holds the best data and the best access.

The ambiguity was on display the very week HISA charged Gramm. It was also investigating the Fair Hill Five, a set of longshots off long layoffs that won across Monmouth and Saratoga on a single August afternoon while a coordinated six-figure coup ran through London betting shops, placed overseas in small stakes so it never moved the American odds or tripped a liability check. Nothing has been proven. As the Guardian framed it, the question is whether someone was unusually clever, unusually lucky, or working with information the public did not have. That last line is Gramm’s case exactly, except that his answer is known. And that is the fight over where he belongs. HISA puts him at the fraud end and calls it insider trading. His own account puts him near the coup end: his own login, his own credentials, an edge the Authority left lying in the open. The sport has no agreed place to file him, so everyone files him wherever their priors already pointed.

The heist is also smaller than the language around it. “He was able to use that information to monetize it,” Lazarus said, and inside information does get treated like gold in this game. Look at what the gold bought. Of the nine horses Gramm claimed for $210,500, the entire post-claim haul was $80,455 in gross purses, and roughly $62,000 of that came from two of them. Two more never raced again. Four others earned under $3,500 apiece. Those are the returns of a decent claiming barn, a little better at the top, not the work of a crystal ball. If perfect knowledge of which horses were sound were a golden ticket, you would not claim four that promptly went nowhere. Inside information in racing shifts the odds. It does not settle the race, because the horse still has to run. On the wagering side, the other place HISA says he monetized, there is no public accounting of what the vet data actually won him at the windows. None of that makes what he did clean. The rule punishes gaining “or attempting to gain” an advantage, so the size of the profit barely matters to the charge. But the story the industry is telling itself, that a professor cracked the code and cleaned up, is doing more work than the numbers support.

That absence extends past the claim box. Gramm played every format at once, the handicapping tournaments and the pari-mutuel pools alongside the claiming game, and he was already good at all of it before any of this. If the vet data were the golden ticket the story implies, you would expect a mark somewhere: results that jumped, a rival crying foul, a player who suddenly could not miss. Instead the scheme surfaced because the past-performances leaked, not because anyone noticed him winning too much. A careful operator would keep a big score quiet, and his wagering is private, so a windfall cannot be ruled out. But one that left no visible trace and drew no complaint from anyone is a strange kind of killing.

What the overblown reading gets wrong is the target. The failure worth being angry about is upstream of Gramm’s cleverness: the industry gathered this data into one vault, called it modernization, and never treated the vault as if it mattered. A design review or an operational-readiness check exists for this. Before a system goes live, someone whose job is to be paranoid asks who can see what, what happens when one account pulls a million rows, and how anyone would know. Serious technology organizations run that gauntlet as routine. Nothing suggests this one did.

Then there is who gets left out of the repair. HISA moved to reimburse the previous owners for their purse money and to claw back Gramm’s handicapping-tournament winnings. The everyday horseplayer, whose money fills the pari-mutuel pools that fund the whole sport, gets nothing but confirmation of an old suspicion: that the game has two tiers, and that the people who can work the plumbing stand on the better one. HISA describes its mission as a balance between equine safety and the interests of the betting public. This incident shows the balance is not real. The sophistication went to the horse, and the horseplayer got the portal that leaked.

The horseplayer also gets the bill. HISA’s costs reach the industry as assessments on tracks and horsemen, and the only real place a track or a horsemen’s group can recover a rising cost is the pari-mutuel pool. HISA does not set takeout, but the pressure it creates runs straight at it. When the cost per start climbs about 12 percent a year, the money comes from somewhere, and the somewhere is either purses, which thin the product, or takeout, which is a direct tax on the bettor’s bankroll. Every dollar spent on a portal that leaked, or on years of defending the Authority’s own constitutionality, is a dollar the industry has to raise. The customer with the least say in it is the one feeding the pools.

A Convenient Villain

The strangest part is the volume of the reaction to one man. A lifetime ban on the table, a referral to the FBI, the phrase “fraud on the market,” all of it over a hole the regulator left open and nine claims worth eighty thousand dollars in purses. Some of the heat is earned, because the conduct was deliberate and the breach of trust is real. Much of it is about what Gramm represents. He gathers into one person nearly every resentment the sport has carried for a decade. He is the deep-pocketed claiming operation buying up other people’s horses. He is the sharp bettor pulling money out of the pools recreational players lose into. He is the quant who treats a soulful game as a spreadsheet and beats the horsemen at it. And he is the Jockey Club insider inside a consolidated elite that much of the industry never wanted. Pour all of that into a single named defendant and the response stops tracking the act. Gramm exploited a real vulnerability and should answer for it. The volume, though, is the sound of an industry venting grievances that predate him and will outlast him.

There is a last irony worth sitting with. Gramm has called himself “a horseplayer first,” someone whose love of the game “came from betting first.” The trust he stands accused of breaking is the trust of the very people he counts himself among.

A Breakdown Gets a Review. So Should This.

HISA already owns the right model. It just has not pointed it here. When a horse breaks down, the sport does not shrug. There is a review of the surface, the veterinary records, the training data, a search for the systemic cause so the next one does not happen. That rigor is the reason the Authority exists. Digital integrity has lived under a softer rule: build the cloud, ship the portal, and learn it leaked when the data turns up on X.

The stakes climb from here, because HISA wants to sell this data. You cannot build a business on an asset you have just shown you cannot secure, and you cannot ask the wagering public to trust a system that told them nothing was wrong while it was leaking. If HISA wants that trust, and the revenue that depends on it, it has to bring the same seriousness to the plumbing that it brings to the racing surface. A breakdown gets a review. This should too.