Nobody Had to Break the Lock, Marshall Gramm, Jockey Club Member Had The Key
Marshall Gramm Say It Isn’t So
HISA To Pursue Charges
For weeks I have been fascinated by the leaked past performances containing veterinary information that was never supposed to be in the hands of bettors. Not because every horse receiving an injection wins, not because every horse receiving shock wave therapy becomes a good claim, and certainly not because veterinary information is some magic handicapping formula. I was fascinated because information has value, and anyone who has wagered seriously on horse racing understands that better information can be an edge.
I have always looked at every wager I make as an investment in an outcome. I use past performances, my own notes and observations, independent speed figures, proprietary calculations and anything else legally available to me. If that gives me an advantage, good. I worked for it. Would I like access to veterinary information other bettors don’t have? Of course I would. But I don’t have it, and I shouldn’t have it if everyone else playing in the same pari-mutuel pools doesn’t have access to it either.
That is why this story mattered to me from the beginning.
When those unusual past performances first appeared publicly, they contained far more than conventional racing information. They reportedly included past-performance information, Ragozin figures and veterinary information, including treatments such as injections and shock wave therapy. That isn’t somebody adding trip notes in the margins. That is information capable of having value in wagering, claiming and potentially other decisions involving racehorses.
I started asking a simple question: Who made them? I went as far down that road as I could publicly. I eventually narrowed my own list to four possibilities. Marshall Gramm was one of them. Now we know where the investigation landed.
The Story Changes
Reports began circulating Monday that Gramm and the Horseracing Integrity and Safety Authority had reached, or were nearing, a negotiated resolution concerning the improper access to confidential veterinary information. Details circulated publicly describing a possible suspension and other sanctions.
Those reports proved premature.
HISA PRESS RELEASE:
HISA Charges Marshall Gramm with Multiple Rule Violations, Including Fraud, Over Unauthorized Access to Confidential Horse Health Information
“August 17, 2026 (Lexington, KY) – Following a comprehensive review that involved internal and third-party expert investigators, the Horseracing Integrity and Safety Authority (HISA) has levied charges against Covered Person Marshall Gramm for multiple violations of HISA rules arising from unauthorized access of confidential horse health information.
In June of this year, past performance data reports (PPs) for the horses Deterministic and Griffin’s Wharf, which included confidential horse health data that should only be accessible to the horses’ connections and Regulatory Veterinarians, were posted on social media by someone unconnected to those horses. Consequently, HISA launched a comprehensive internal investigation into the matter.
HISA’s preliminary investigation concluded that there had not been any system breach by a person or entity who did not have prior authorization to access the HISA Portal. Nonetheless, HISA extended its initial investigation to search for any vulnerabilities in its technology systems that may have allowed someone with authorized access to the HISA Portal to view and share confidential horse health information. HISA committed to reporting the findings of its extended investigation at its conclusion.
That investigation included robust information sourcing and interviews conducted by HISA employees and contractors, as well as an independent third-party forensic cyber security analysis conducted by Arete, a leading expert in the field. The results unanimously pointed to Marshall Gramm being solely responsible for accessing confidential horse health information and creating PPs for horses to which he had no legitimate connection.
The investigations concluded that Mr. Gramm deliberately and methodically misappropriated confidential horse health information from the HISA Portal during a 6-week window beginning in early May and concluding in mid-June. Based on information gathered through the investigations, Mr. Gramm developed an automated method of obtaining the confidential horse health information at scale in a manner designed to mimic authorized activity to avoid detection by HISA’s security systems. Mr. Gramm used the resulting information to create the PPs that were shared on social media. Additionally, during this 6-week window, Mr. Gramm participated in handicapping contests, engaged in pari-mutuel wagering and claimed several Covered Horses across multiple jurisdictions and racetracks. HISA will be seeking restitution of any and all proceeds derived from such activities conducted during the relevant time period for the affected entities and individuals.
When confronted with the findings of these investigations, Mr. Gramm admitted that he is the source of the PPs for Deterministic and Griffin’s Wharf. The harm that Mr. Gramm has caused to the Thoroughbred racing community is significant. HISA has initiated enforcement actions against Mr. Gramm for HISA rule violations relating to fraud and unauthorized access of horse health records. In addition to these internal actions, HISA will evaluate and pursue, as necessary, all available remedies and claims arising from the harm caused to horse owners, trainers and veterinarians who rely on the confidentiality of the HISA Portal, Mr. Gramm’s fellow contest participants and the wagering public. HISA will also be sharing the information it has collected from its investigations with federal and local law enforcement, state racing commissions and all other relevant authorities so they may consider any appropriate actions that are outside HISA’s remit.
“There must be significant consequences for individuals who violate the integrity of our rules and obtain and abuse confidential horse health information,” said HISA CEO Lisa Lazarus. “HISA will take every necessary step to fiercely protect the integrity of Thoroughbred racing and ensure that violators of our rules are punished appropriately.”
HISA has made changes to its technology systems to prevent any similar unauthorized access going forward. HISA is also devoting additional time and resources to ensuring that its systems are well-prepared to stop any attempts to use new tools and technologies to obtain confidential information.
About the Horseracing Integrity and Safety Authority
When the Horseracing Integrity and Safety Act was signed into federal law, it charged the Horseracing Integrity and Safety Authority (HISA) with proposing and enforcing uniform safety and integrity rules in Thoroughbred racing in the United States. Overseen by the Federal Trade Commission (FTC), HISA is implementing, for the first time, a uniform national set of rules applicable to every Thoroughbred racing participant and racetrack facility. HISA has two programs: the Racetrack Safety Program, which went into effect on July 1, 2022, and the Anti-Doping and Medication Control (ADMC) Program, which went into effect on May 22, 2023.
The Racetrack Safety Program includes operational safety rules and national racetrack accreditation standards that seek to enhance equine welfare and minimize equine and jockey injury. The Program expands veterinary oversight, imposes surface maintenance and testing requirements, enhances jockey safety, regulates riding crop use and implements voided claim rules, among other important measures.
The ADMC Program includes a centralized testing and results management process and applies uniform penalties for violations efficiently and consistently across the United States. These rules and enforcement mechanisms are initially administered by an independent body, the Horseracing Integrity & Welfare Unit (HIWU), established by Drug Free Sport International. HIWU oversees testing, educates stakeholders on the Program, accredits laboratories, investigates potential ADMC violations and penalizes any such violations, subject to the FTC’s plenary review.”
The official charges go considerably further than the reports circulating earlier today. HISA is not describing someone who merely stumbled upon a vulnerability; it alleges Gramm deliberately and methodically obtained confidential information at scale through an automated process designed to mimic authorized activity and avoid detection.
A negotiated settlement and contested charges are not the same thing. Charges are allegations unless and until they are admitted, adjudicated or otherwise resolved. Gramm is entitled to respond to them, and Past the Wire will report that response just as we report HISA’s allegations. But the filing finally gives this story something it desperately needed: facts capable of being examined instead of rumors capable of being repeated. And there have been plenty of rumors.
Who Is Marshall Gramm?
That is part of what makes this story so significant.
Gramm isn’t some anonymous owner who stumbled onto information he didn’t understand. He is one of the most sophisticated horseplayers in the game. He is an economics professor at Rhodes College whose academic work has included wagering markets. He is co-founder of Ten Strike Racing, a successful racing partnership. He won the 2020 Breeders’ Cup Betting Challenge, one of the country’s premier live-money handicapping tournaments. He has been widely regarded as an accomplished bettor, owner, tournament player and authority on racing economics and wagering.
Gramm was also elected to The Jockey Club in 2024.
His connection to sophisticated wagering isn’t incidental to his biography. He has taught a Rhodes College course on the economics of racetrack wagering markets, and his interview series associated with that course included prominent racing and wagering figures, including Pat Cummings.
In other words, Marshall Gramm understood the value of information. That doesn’t establish what he did with any particular information. It does make the questions surrounding access to it considerably more consequential.
Access Is Only the Beginning of the Question
The explanation now circulating publicly is that Gramm accessed information through credentials he legitimately possessed as an owner and discovered that manipulating identifying information within the system allowed him to see veterinary records associated with horses other than his own.
If HISA confirms that basic description, then there are two separate issues, and racing should be intellectually capable of examining both simultaneously.
The first belongs to HISA.
How could confidential veterinary information entrusted to a national regulatory system be exposed to somebody who wasn’t authorized to see it? That is a legitimate and serious question. If changing an identifier or URL while authenticated permitted one owner to view another owner’s confidential veterinary information, somebody has a significant security and access-control failure to explain. The second issue belongs to the person who discovered the vulnerability. What did you do once you discovered it? Those are not competing questions.
Don’t Blame the Unlocked Door for Walking Through It
Taking Marshall Gramm’s reputation and status within the industry completely out of the equation, any attempt to make this exclusively about a vulnerability in HISA’s system falls on deaf ears with me.
Vulnerabilities exist in systems everywhere. Some get patched immediately. Some aren’t discovered until somebody exploits them. Some systems unfortunately depend upon people respecting boundaries they technically might be capable of crossing. That can be a failure by the people who built the system. Exploiting a vulnerability for personal enrichment, information, an edge or gain, if that is what occurred, is something entirely different. It is an affirmative decision. If I walk into a bank and discover a security vulnerability and use it to rob the bank, the bank absolutely has a security problem. That doesn’t make the money mine. If a company employs a security guard who is incapable of stopping me and I decide to take advantage of him, the company may have exercised terrible judgment. That doesn’t absolve my decision. Two parties can be wrong at the same time.
HISA should answer for whatever vulnerability existed. The person who knowingly went beyond his authorized access should answer for that decision if HISA proves that is what occurred. Trying to turn one into an excuse for the other only raises another uncomfortable question: Are you sorry it happened, or sorry you got caught?
Show Us the Audit Trail
This is where I think horseplayers need to resist the temptation to choose teams. I don’t care whether you like HISA. I don’t care whether you hate HISA. I don’t care whether Marshall Gramm is your friend, your enemy, someone you admire or someone you have never met. I want the audit trail.
When did the unauthorized access begin? When did it end? How many horses were accessed? Which horses? How many times? What information was viewed? Was any of it downloaded, copied or distributed? Who received it? Were any of those horses subsequently wagered upon, purchased or claimed by Gramm, Ten Strike Racing, partners or anyone to whom the information was provided? And if there were claims during the relevant period, examine them.
That does not mean every claim was improper. It doesn’t mean every winning wager was tainted. It doesn’t mean every success Gramm has ever enjoyed suddenly becomes illegitimate. It means you investigate. Because this isn’t merely about protecting owners’ confidential information. It is about protecting everyone competing economically against someone possessing information unavailable to them.
That includes horseplayers.
The Accomplishments Now Get Looked At Differently
There is an uncomfortable part of this story that shouldn’t be avoided simply because Gramm was respected. Once someone with significant success as a bettor, tournament player, owner and claiming operation becomes the subject of charges involving improper access to potentially valuable non-public information, people are naturally going to look backward. That isn’t proof that previous success was illegitimate. It would be irresponsible to claim otherwise without evidence. But pretending nobody will reexamine it would be equally ridiculous. Baseball learned this lesson during the steroid era. Once information emerged about performance-enhancing drug use, accomplishments that had previously been viewed through one lens were inevitably viewed through another. Records remained in the books, but people asked different questions about how they were achieved.
Gramm’s wagering accomplishments, tournament success and racing operation now exist alongside another fact: HISA has brought charges concerning his access to confidential veterinary information. Where those two things intersect, if they intersect at all, is precisely what a thorough investigation should determine.
The Jockey Club Has Questions Too
The Jockey Club previously said its investigation found no unauthorized access or breach of its InCompass Track Manager system and announced additional steps to restrict access to veterinarians’ list information. That may ultimately prove entirely consistent with what happened. A traditional external breach is very different from someone entering a system through legitimate credentials and then accessing information beyond what those credentials were intended to permit. But The Jockey Club elected Gramm as a member in 2024. That makes this uncomfortable.
It doesn’t make The Jockey Club responsible for Gramm’s alleged conduct. Organizations cannot know everything every member may eventually do. But racing has an extraordinarily small inner circle, and when someone admitted into that circle becomes the subject of an integrity proceeding involving information unavailable to the wagering public, transparency becomes more important, not less. No circling the wagons. No protecting friends. No protecting institutions. Put the facts on the table.
What Happens Next Matters
There is another reason I am watching how HISA handles this. We criticize regulators when they deserve criticism. I certainly do. But fairness requires acknowledging the opposite as well. HISA moved quickly when the leaked information surfaced, publicly acknowledged the issue and investigated it. Lisa Lazarus publicly stated that HISA had found no evidence of an outside breach or unauthorized intrusion into its portal. More importantly, HISA didn’t stop there. Now, with settlement discussions apparently not producing a final resolution, the matter has moved into formal charges.
That is what an integrity system is supposed to do. Investigate, establish the evidence, bring charges where warranted and provide the accused an opportunity to answer them.
Then show us what happened. Because punishment is only part of this.
The larger responsibility is determining the scope.
Was Gramm the only person who discovered this vulnerability? Was he the only person who accessed information he wasn’t entitled to see? How long did the vulnerability exist? Can HISA determine every unauthorized record that was accessed? Can it determine whether information was subsequently shared? Has the vulnerability been completely closed? Those answers matter more to me than winning today’s argument on X.
The Pipeline
Back in June I wrote that the person who accessed the veterinary information might not be the person who assembled the past performances; the assembler might not be the consumer; and the person who ultimately put them on social media might be none of the above. I called it a pipeline. At the time, we didn’t know where Marshall Gramm, or anyone else, fit into it. Now HISA has told us where it believes Gramm fits.
Am I surprised? No. Gramm made my short list. Am I disappointed? Yes. Not in Marshall personally. I don’t know him, his character or anything about him that isn’t public. I’m disappointed in myself. I should have been able to figure it out before HISA did. More importantly, as a bettor, do I feel cheated? Indeed I do, and I think every horseplayer should at least ask himself the same question. In recent days we may have watched one of the most extraordinary alleged betting coups in modern racing unfold in an entirely separate investigation. Now, in another matter, one of racing’s most respected sophisticated players faces allegations involving access to information the rest of us didn’t have.
The game is tough enough. All I want is a level playing field.
