When They Show You Who They Are, Believe Them
There are moments when an industry tells you exactly who it is. Not necessarily by what it does when everything is going well, but by what it does when something goes wrong. Horse racing is having one of those moments.
On Wednesday, The Jockey Club finally issued a statement addressing questions surrounding its relationship with the Horseracing Integrity and Safety Authority and the security of racing data. Considering everything that has happened, everything that has been alleged, and everything that remains unanswered, I read it more than once. I came away disappointed. Not because I expected The Jockey Club to accept responsibility for something we do not know it was responsible for. I didn’t. Not because I expected it to implicate itself, HISA, one of its subsidiaries, or anyone else without facts supporting that. I didn’t. I expected leadership. There is a difference.
The statement begins by saying The Jockey Club is addressing questions about its “role in data security” and its relationship with HISA’s information systems. It then gets right to the point:
“While The Jockey Club is a strong supporter of the institutional necessity of HISA, we want to be clear that we have no impact or influence on HISA’s daily operations or any facet of their software development.”
First, “the institutional necessity of HISA” is an interesting choice of words. That is not quite the same thing as simply saying we strongly support HISA. It leaves some daylight between believing racing needs a national regulatory structure and embracing everything being done by the structure currently occupying that space. More importantly, however, look at what is being answered. Daily operations. Software development. Was that really the question?
I don’t recall anyone seriously suggesting that The Jockey Club sits inside HISA headquarters directing its investigators, writing its software or making its day-to-day enforcement decisions. The questions raised by this mess are considerably broader. Who had access to what? Where was sensitive information stored? Which systems communicated with which other systems? Who could see the information through legitimate access granted because of another role within racing? How did information that was not supposed to be in certain hands apparently wind up there? For how long? And perhaps most importantly, what is being done to make sure it cannot happen again?
The statement then tells us something important. The Jockey Club provides HISA with entries, results, workouts and information about covered horses, including claims information, state veterinarian’s list information, veterinary treatment and procedure records and certain health information. HISA, in turn, provides information back that can be used by racing offices and regulatory veterinarians. In other words, there is a significant and necessary exchange of data. That doesn’t establish wrongdoing. It doesn’t establish a security breach originated with The Jockey Club. It doesn’t establish anything nefarious at all. It does, however, demonstrate exactly why the industry’s information infrastructure cannot be discussed as though every institution lives on its own island.
Then came perhaps the most carefully constructed sentence in the entire statement:
“The Jockey Club members do not have special access to the HISA portal as a result of their membership.”
As a result of their membership. That may be completely accurate. I have no reason to say otherwise. It also answers an extraordinarily narrow question. The Jockey Club has members who wear other hats throughout this industry. Racing has owners who serve as stewards. People throughout the sport can simultaneously be owners, breeders, racetrack officials, regulators, board members, veterinarians, executives or participants in other capacities. Someone can therefore have entirely legitimate access to information because of one role while also being affiliated with another organization. That isn’t an accusation. It is the structure of American horse racing. Nobody I know thought membership in The Jockey Club came with a HISA password. The concern is the overlapping ecosystem itself, and pretending that the important distinction is why somebody has access instead of understanding who has access and what they can see misses the larger point entirely.
There is also some history here that cannot simply disappear because circumstances have become uncomfortable. The Jockey Club did not watch HISA’s creation from the grandstand. It championed HISA. It supported HISA. It advocated for the national structure HISA represented. There was also a financial relationship involving loans to HISA that has been publicly documented and that I have written about before. The exact history, amounts and disposition of those loans deserve to be viewed alongside the relationship now being described.
None of that means The Jockey Club runs HISA. It doesn’t mean The Jockey Club controls HISA. And it certainly doesn’t mean The Jockey Club is responsible for whatever ultimately happened with information that allegedly got somewhere it wasn’t supposed to be. But when you help champion something, advocate for it, financially support it and exchange important industry data with it, there is something jarring about the first instinct during a crisis being to explain the boundaries of your responsibility. Especially after taking this long to say anything.
This wasn’t an immediate response issued hours after a story broke while everyone was scrambling to determine what happened. There was time to think. Time to measure the words. Time to decide what message one of the most influential institutions in American racing wanted to send to owners, trainers, breeders and, yes, horseplayers. The message we received was essentially this: HISA is independent. We don’t run its daily operations. We don’t develop its software. Here is the information we exchange. Membership doesn’t provide special portal access. Data needs to be secure. All of that may be true.
But where is the leadership?
Where is: We championed HISA, and therefore we believe the industry deserves a complete accounting of what happened?
Where is: Regardless of organizational boundaries, confidence in racing’s data is essential to the integrity of the wagering product and we will do everything within our ability to help determine what occurred?
Where is the call for transparency?
Where is the demand that the people wagering billions of dollars on this sport be told how protected information apparently moved, who could access it, what safeguards failed and what safeguards have now been implemented?
Where is the urgency?
This is bigger than The Jockey Club, and that is really the point. This is horse racing. It permeates virtually every level of the game. When everything is going well, everybody wants to stand at the microphone. When something goes wrong, everybody discovers the organizational chart. We can’t even consistently stagger post times so two racetracks aren’t running simultaneously and competing for the same wagering dollar. Think about how absurd that is. An industry desperate to increase handle routinely makes its customers choose between two products because individual racetracks cannot coordinate a few minutes on a clock.
Then we construct a new championship concept for three-year-olds involving the Kentucky Derby and Belmont Stakes and somehow the Preakness Stakes, the second jewel of the Triple Crown, winds up outside looking in. How does that happen? The same way so many things happen in racing. My track. My organization. My jurisdiction. My data. My revenue. My interests. My problem. Your problem. Every man for himself. Until something succeeds. Then everybody helped.
And when something goes badly enough, those organizational walls become fortifications. This isn’t leadership. It is one of the fundamental reasons this sport has struggled for decades to solve problems that other major sports would address collectively.
The irony is that HISA itself was sold, in considerable part, as the answer to exactly that problem. Racing couldn’t regulate itself uniformly. States operated differently. Rules differed. Enforcement differed. Standards differed. The sport needed national uniformity. The Jockey Club was one of the strongest institutional voices supporting that concept. Now racing faces a crisis involving the integrity and security of information, and suddenly independence and separation are the words of the day. You cannot have it both ways.
You cannot spend years arguing that racing’s problems require collective national solutions and then, when a serious problem emerges, retreat behind the corporate fence and explain precisely where one organization’s responsibility stops and another one’s begins. Or perhaps you can. Horse racing has been doing it forever. That doesn’t make it leadership.
There is another reason this is important. Horseplayers are not peripheral stakeholders in this conversation. We fund the game. Every entry, every data point, every past performance, every tote fluctuation and every piece of information that can potentially provide someone an advantage matters because we are wagering against one another. Information has value. Timing has value. Access has value. Anyone who has spent his life gambling on horses understands that instinctively. So when confidence in the handling of racing information is shaken, the proper institutional response should not merely be a description of who doesn’t control whose software. It should be urgency. It should be transparency. It should be cooperation. It should be every major institution in this sport saying, we want to know exactly what happened too, and we are going to help find out. Maybe The Jockey Club is doing precisely that privately. I hope it is. But that isn’t what Wednesday’s statement conveyed. What it conveyed was distance. That is particularly disappointing because The Jockey Club has long presented itself as something more than a breed registry. Its own statement reminds us that it “provides support and leadership on a wide range of important industry initiatives.” Leadership. Their word. And leadership isn’t accepting blame for something you didn’t do. Leadership isn’t making allegations before the evidence exists. Leadership isn’t interfering with an independent regulator.
Leadership is recognizing that sometimes a problem is bigger than the boundaries of your own organization. Leadership is standing up when the sport you claim to lead has a crisis of confidence. Leadership is demanding answers even when those answers may be uncomfortable. Leadership is not telling everyone whose problem it isn’t.
For years, racing’s inability to work collectively has been treated like an unfortunate quirk of a fragmented industry. It isn’t. It is one of our core problems. It is why tracks run on top of each other. It is why major racing organizations can pull in opposite directions. It is why the three races that have defined the American three-year-old for generations cannot necessarily find themselves in the same championship concept. It is why meaningful reform so often turns into a turf war. And when a genuine crisis arrives, everybody doubles down. Protect the institution. Define the jurisdiction. Draw the boundary. Point to the other guy’s door. The Jockey Club may ultimately have absolutely no responsibility whatsoever for the underlying data issues now being investigated. If the evidence establishes that, it should be stated just as plainly. But this isn’t about assigning blame without evidence. It is about something racing desperately needs and too rarely gets. Leadership from the top down.
The Jockey Club has spent more than a century occupying a position of enormous influence in American Thoroughbred racing. With that influence comes something more important than responsibility for software, portals or daily operations. It comes with responsibility to lead. Wednesday was an opportunity to do that. Instead, we got an explanation of where The Jockey Club ends and HISA begins. At a moment when racing desperately needed somebody to talk about where the sport begins.
That is the problem. And it is much bigger than one statement.
Maybe that is the part racing still doesn’t understand.
When the Titanic struck the iceberg, the problem eventually wasn’t determining which department of the White Star Line was responsible for the ice warning, who designed which compartment, or who had authority over which part of the ship. The ship was sinking. And there weren’t enough lifeboats. Horse racing has spent far too long operating as a collection of separate compartments, each protecting its own interests, guarding its own territory and defining precisely where its responsibility begins and ends. The problem with that philosophy is eventually the water doesn’t care about the walls. Neither do the people left without a boat. This sport doesn’t need another organizational chart explaining who isn’t responsible. It needs somebody on the bridge.
We have all the lifeboats you need, shut up and bet:
The Jockey Club Statement:
News Releases
| Wednesday, August 26, 2026 | Contact: Shannon Luce 859.224.2716 |
| Statement on The Jockey Club’s Relationship with HISA | |
We’re issuing this statement to directly address recent questions raised about The Jockey Club’s role in data security and our relationship with HISA’s information systems. While The Jockey Club is a strong supporter of the institutional necessity of HISA, we want to be clear that we have no impact or influence on HISA’s daily operations or any facet of their software development. That’s intentional. In order for HISA to be successful, it must operate with independence and without interference from any outside organization, including ours. For further clarity, The Jockey Club provides HISA with a range of data as outlined below:Racing: Information on entries, results, and workouts.Covered Horses: Information such as name, reference number, sex, color, year of birth, dam, claims information, state veterinarian’s list details, veterinary treatment and procedure records, and specific health information (e.g., vaccinations, Coggins, and health certificates).Connections: Information on jockey, trainer, and owner name.The Jockey Club receives the following information from HISA (subject to role-based security controls), which is used by racetrack racing offices during the entry process to determine eligibility of participants and by regulatory veterinarians to ensure the welfare and safety of horses competing in races:Covered Horses: HISA number, veterinarian’s list information, location, time-limited treatment records (temporarily available to regulatory veterinarians, information not stored), and race eligibility (temporarily available, information not stored).Connections: jockey, trainer, and owner HISA number. As stated previously, The Jockey Club members do not have special access to the HISA portal as a result of their membership. We understand the stakes. We hear the concerns of horse owners, trainers, horseplayers and participants in every corner of the sport. Data on industry-regulated systems must be accurate, secure, and easy to navigate in order to succeed. The Jockey Club, founded in 1894 and dedicated to the improvement of Thoroughbred breeding and racing, is the breed registry for Thoroughbreds in the U.S., Canada, and Puerto Rico. In fulfillment of its mission, The Jockey Club provides support and leadership on a wide range of important industry initiatives, and directly or through subsidiaries, it serves the information and technology needs of the sport of Thoroughbred racing. Among its many supported initiatives are America’s Best Racing (americasbestracing.net), OwnerView (ownerview.com), and the Thoroughbred Incentive Program (tjctip.com). Additional information is available at jockeyclub.com. | |