HISA could seek lifetime ban for owner Gramm over unauthorized access to portal

The Horseracing Integrity and Safety Authority has levied charges against horse owner Marshall Gramm for multiple violations of HISA rules arising from unauthorized access of confidential horse health information and is likely to seek a lifetime ban of Gramm from the sport, regulatory officials said Monday.

Gramm was found to have gained unauthorized access to the medical records of thousands of horses to which he was not connected. Specifically, the past performances of two horses - Deterministic and Griffin’s Wharf, who ran on Belmont Stakes Day, June 6, at Saratoga - included dates that those horses received shock wave therapy treatments were posted on social media. Those treatments should have only been accessible to the horses’ connections and regulatory veterinarians.

A HISA investigation, with assistance from a third-party forensic cyber security firm, Arete, a leading a leading expert in the field, identified Gramm as being responsible for accessing the health information and creating past performances for those horses to which he had no connection.

Gramm, when confronted with that information by a HISA investigator while at Saratoga, admitted to having accessed that information, according HISA CEO Lisa Lazarus, who talked about the matter Monday at a mid-afternoon press conference with reporters.

“Mr. Gramm used essentially an automated and invisible browser to download records at scale while employing methods to avoid detection,” Lazarus said. “Mr. Gramm is a university professor and certainly has been in many ways a valuable contributor, but there’s no question he would know what he was doing was wrong and was unethical and he was violating multiple rules.”

Lazarus said that hours before Gramm was confronted by HISA investigators about his involvement, Gramm participated in a conference call along with members of HISA and The Jockey Club to discuss if the industry needed to make policy changes moving forward.

“Mr. Gramm spent an hour on that call with us contributing his ideas to where we go from here without once acknowledging that he was actually the one that caused the fact we had to talk about changes in policy,” Lazarus said.

Gramm, in a lengthy text response to a press release detailing charges against him before HISA held its press briefing, denied using any subterfuge to avoid detection.

“I used my own account and credentials and never attempted to conceal my identity or circumvent HISA’s security,” Gramm wrote. “Once logged into my account, I bypassed no security protocols or other safeguards to access the information.”

Lazarus said that during the timeframe in which Gramm had unauthorized access to horse’s medical records - roughly a six-week span from early May to mid-June - Gramm claimed nine horses. Gramm races under the moniker Ten Strike Racing but that entity has multiple partners.

Lazarus said that on Monday she contacted the previous owners of the nine horses that were claimed and “made clear to them that we would make restitution to them for any purse earnings that Mr. Gramm earned with their horses after that horse was claimed.”

Lazarus estimated that the claimed horses earned between $80,000 to $90,000 but that the horses would not be returned to the previous owner. Lazarus said HISA would reimburse those owners and then seek to retrieve the money from Gramm via legal proceedings.

Lazarus said that Gramm accessed the available health history records of all nine horses that were claimed. Among the claims made by Ten Strike Racing during that time were Indy Rags, who was claimed for $25,000 out of a May 2 race at Aqueduct, and Tiger Moon, who was taken for $5,000 out of a May 10 race at Monmouth Park. Tiger Moon, trained by Lindsay Schultz, has two wins, a second, and a sixth in four starts since the claim. Indy Rags, trained by Michelle Giangiuilo, is 0 for 3 since the claim.

Lazarus, who said that Gramm participated in handicapping contests during this time, as well as made legal wagers, likened what Gramm did to insider trading in the stock market.

“He had access to information that nobody else did. He was able to use that information to monetize that,” Lazarus said. “We find that is essentially concerning and damaging with respect to the claiming horses. . . . You can make all kinds of arguments whether or not information is ultimately going to make you a better horseplayer or do better in a contest. I don’t think anybody can debate the fact that if you have health horse information ahead of a claiming race and you make a claim based on that information that you have a massive advantage.”

Gramm will have a chance to answer these charges in hearings with HISA scheduled for Sept. 14 and 16. In the interim, he will still be able maintain his owner’s license, according to John Roach, counsel for HISA.

“I anticipate the enforcement counsel will be seeking pretty severe sanctions up to and including a lifetime ban,” Roach said Monday.

Gramm, a professor of economics at Rhodes College, was elected to The Jockey Club in August 2024. He has been a speaker on many panels at industry-coordinated events.

Both Gramm and Lazarus acknowledged that the two parties were working on settlement agreement but Lazarus said those negotiations broke down when Gramm requested that HISA “conceal some information in exchange for a settlement,” she said. “That was always a complete no-go for us. . . . We had to share publicly what had happened.”

Gramm wrote he intends “to vigorously defend myself in the HISA proceedings.”

Gramm wrote that he made a mistake in not bringing the vulnerability of HISA’s computer system to their attention sooner.

“I should have done so, and I regret that I did not,” Gramm wrote. “I want to apologize for the difficulties this situation has caused. Horse racing has been an important part of my life for many years and I care deeply about the integrity of the sport. I remain willing to work with HISA to address the access-control weaknesses that allowed this information to be available. Making me the focus of this matter is a distraction from the fundamental issues HISA needs to address with it systems.”

:: Want to learn more about handicapping and wagering? Check out DRF's Handicapping 101 and Wagering 101 pages.