HISA charges owner Gramm had unauthorized access to horse health portal

The Horseracing Integrity and Safety Authority has levied charges against horse owner Marshall Gramm for multiple violations of HISA rules arising from unauthorized access of confidential horse health information, the regulatory body announced in a press release on Monday.

In June, past performances for the horses Deterministic and Griffin’s Wharf - who were competing in races on the June 6 Belmont Stakes Day card at Saratoga - which included health data such as dates of shock wave therapy treatments that only should have been accessible to the horses’ connections and regulatory veterinarians, were posted on social media by someone unconnected to those two horses.

HISA conducted an internal investigation into the matter and initially concluded there had not been any system breach by a person or entity who did not have prior authorization to access the HISA Portal. HISA extended its investigation and conducted more interviews and with the help of a third-party forensic cyber security analysis conducted by Arete, a leading expert in the field, identified Gramm as being responsible for accessing the health information and creating past performances for those horses to which he had no connection.

Further, the investigations concluded that Mr. Gramm deliberately and methodically misappropriated confidential horse health information from the HISA Portal during a six-week window beginning in early May and concluding in mid-June. Based on information gathered through the investigations, Mr. Gramm developed an automated method of obtaining the confidential horse health information at scale in a manner designed to mimic authorized activity to avoid detection by HISA’s security systems. Mr. Gramm used the resulting information to create the past performances that were shared on social media.

Additionally, during this six-week window, Gramm participated in handicapping contests, engaged in parimutuel wagering, and claimed several HISA-covered horses across multiple jurisdictions and racetracks. HISA will be seeking restitution of any and all proceeds derived from such activities.

According to the release, Gramm admitted that he was the source for the past performances for Deterministic and Griffin’s Wharf shared on social media.

Gramm, a professor of economics at Rhodes College, was elected to the Jockey Club in August 2024. He races under the moniker Ten Strike Racing and that entity has multiple partnerships.

Among the claims made by Ten Strike Racing during that time were Indy Rags, who was claimed for $25,000 out of a May 2 race at Aqueduct, and Tiger Moon, who was taken for $5,000 out of a May 10 race at Monmouth Park. It is not clear if Gramm accessed health information to claim either of these two horses. Tiger Moon, trained by Lindsay Schultz, has two wins a second and a sixth in four starts since the claim. Indy Rags, trained by Michelle Giangiuilo, is 0 for 3 since the claim.

HISA has initiated enforcement actions against Gramm for HISA rule violations relating to fraud and unauthorized access of horse health records. In addition to these internal actions, HISA will evaluate and pursue, as necessary, all available remedies and claims arising from the harm caused to horse owners, trainers, and veterinarians who rely on the confidentiality of the HISA Portal, Gramm’s fellow contest participants, and the wagering public. HISA will also be sharing the information it has collected from its investigations with federal and local law enforcement, state racing commissions, and all other relevant authorities so they may consider any appropriate actions that are outside HISA’s remit.

“There must be significant consequences for individuals who violate the integrity of our rules and obtain and abuse confidential horse health information,” Lisa Lazarus, HISA CEO, said in a press release. “HISA will take every necessary step to fiercely protect the integrity of Thoroughbred racing and ensure that violators of our rules are punished appropriately.”

Gramm, in a lengthy text message, said he intends “to vigorously defend myself in the HISA proceedings.”

He further explained “the information at issue was available through my authorized HISA account. It was a large dataset, and at the time I accessed it, I had not fully reviewed its contents or understood the scope of the information it contained.

“I used my own account and credentials and never attempted to conceal my identity or circumvent HISA’s security. Once logged into my account, I bypassed no security protocols or other safeguards to access the information.

“Where I exercised poor judgement was in not bringing the vulnerability to HISA’s attention sooner after it became a public story. I should have done so, and I regret that I did not. I want to apologize for the difficulties this situation has caused.

“Horse racing has been an important part of my life for many years and I care deeply about the integrity of the sport. I remain willing to work with HISA to address the access-control weaknesses that allowed this information to be available. Making me the focus of this matter is a distraction from the fundamental issues HISA needs to address with it systems.”

:: Want to learn more about handicapping and wagering? Check out DRF's Handicapping 101 and Wagering 101 pages.