Marshall Gramm's quiet six-week trawl through the HISA portal has erupted into one of the most consequential integrity cases modern U.S. racing has seen, with regulators charging the prominent owner and bettor with fraud and weighing a lifetime ban over what they say was a systematic misuse of confidential veterinary records.
In an August 17 release, the Horseracing Integrity and Safety Authority said internal investigators and outside cybersecurity firm Arete concluded that Gramm “deliberately and methodically” misappropriated confidential horse health information from the HISA portal over a window beginning in early May and ending in mid-June. HISA charged him under Rule 2251, which governs access to veterinary treatment records, and Rule 8100(h), which covers fraud, attempted fraud or misrepresentation in connection with the care or racing of a covered horse. The authority's public documents describe Gramm's conduct as “fraud on the market,” arguing that he exploited information unavailable to other participants while engaged in wagering, handicapping contests and claiming activity.
According to HISA's account, Gramm used his legitimate owner login as a Responsible Person on the portal, then developed an automated method to pull data on horses with which he had no authorized connection, mimicking normal browser behavior to avoid detection. Investigators say the process ultimately touched “millions of records,” including detailed treatment histories that covered intra-articular joint injections and other procedures that never appear in public past performances. During the same six-week period, HISA says he accessed confidential health information on each of nine horses he subsequently claimed, and that those horses later earned roughly $80,000 in purse money that the authority now plans to claw back and return to their previous owners.
Gramm's profile — economics professor at Rhodes College, leading partner in Ten Strike Racing, Jockey Club member and accomplished contest player — has amplified the sense of shock that someone so firmly embedded in the industry's establishment would be at the center of a data-privacy scandal. A statement posted by Gramm on X and carried by outlets such as Paulick Report and Horse Racing Nation emphasized that he logged in with his own credentials, “bypassed no security protocols or other safeguards” and did not attempt to conceal his identity. HISA, for its part, stresses that Gramm's use of automation to harvest data went far beyond any legitimate owner function and that the portal vulnerability he exploited has since been closed, with no evidence that other users employed the same method.
The controversy first burst into public view when customized past performances including veterinary treatments for horses such as Deterministic and Griffin's Wharf began circulating on social media in June, showing injection histories and joint procedures alongside form lines and speed figures. Gramm has acknowledged being the source of those enhanced PPs, which he initially created and shared with an associate before they were further redistributed online. According to commentary in Past The Wire and a detailed breakdown on Robin Howlett's “Big Data Meets the Backstretch,” the cards quickly raised alarms among horseplayers and horsemen who realized they were looking at information drawn from a restricted veterinary database rather than the usual public race charts.
For racing insiders, the most sensitive piece of the puzzle is the claiming angle. HISA's press call, summarized by outlets including Yahoo Sports and DRF en Español, asserted that Gramm accessed confidential vet information on each of the nine horses he claimed during the relevant period, then dropped slips on those horses armed with knowledge of their recent injections and treatments that other claimers did not have. In a game where subtle clues about joint wear, layoff patterns and barn changes already drive the claiming market, knowing exactly which knees and ankles have been repeatedly needled or which backs have been treated with specific therapies can dramatically alter a horse's valuation in a way that reverberates through fields, purses and, ultimately, the betting pools.
HISA CEO Lisa Lazarus has framed the response as a line-in-the-sand moment for data integrity, telling ESPN that “there must be significant consequences for individuals who violate the integrity of our rules and obtain and abuse confidential horse health information” and vowing that violators “are punished appropriately.” In public comments covered by Past The Wire and Horse Racing Nation, Lazarus said enforcement will seek sanctions up to and including a lifetime suspension, along with restitution of purses, contest winnings and other proceeds tied to the six-week window. The authority has also emphasized that third-party forensic work pointed solely to Gramm's activity and that no broader breach of its system was found.
The Jockey Club moved quickly to distance its own platforms from the scandal, issuing a statement saying Gramm's membership provided “no special or additional access,” that its InCompass systems and data were not breached, and that the vet information at issue came from HISA's portal rather than its Track Manager product. That clarification followed weeks of speculation about whether the leak might have originated from other industry databases, a concern that underscored how deeply integrated veterinary lists, qualifiers and treatment logs have become in day-to-day backstretch operations even as they remain shielded from the betting public. For rank-and-file horseplayers, the episode has highlighted a structural imbalance: sophisticated insiders can benefit from a layer of medical intelligence that never appears in the PPs on which everyone else is asked to price races.
Gramm's own defense has leaned heavily on his identity as a data analyst, saying in statements reproduced by multiple outlets that assembling and interrogating large datasets is something he has done throughout his academic and racing career. He has acknowledged poor judgment in failing to alert HISA to the portal vulnerability once the existence of the vet-enhanced PPs became public, and he has apologized for the disruption the episode has caused. At the same time, he disputes HISA's characterization of his conduct as “hacking,” insisting that he never circumvented security protocols and that the information he accessed was available behind his authorized login in ways the authority should have foreseen.
The reaction across the industry has been sharply divided. Commentators at Paulick Report and other trade outlets note that lifetime sanctions have historically been reserved for vets and trainers involved in systemic medication schemes that directly endangered horses, and they question whether aggregating already-existing treatment records, however improper, should be treated in the same category. Others, including several voices quoted by Horse Racing Nation, argue that using confidential medical information to gain an edge in claiming and wagering is a fundamental betrayal of the sport's integrity that merits the harshest available response precisely because Gramm operates both as an owner and as a high-volume bettor. That split mirrors a broader debate over how far HISA should go in policing off-track behavior in an era when big-data handicapping strategies increasingly blur the line between routine analysis and potential market manipulation.
For handicappers, the case is a warning shot about the future of information in the game. If HISA prevails in seeking full restitution of purses and contest money from Gramm, it will set a precedent that the use of non-public veterinary data is not just a rules violation but a form of financial wrongdoing that can unwind results months after the fact. If, on the other hand, the ultimate sanction ends up closer to a multi-year suspension, the sport may have to confront difficult questions about why some forms of insider advantage — like barn whispers about a horse's knees or private gallop observations — remain accepted currency while digitally scraping the same information crosses a bright red line. Whatever the final ruling, Gramm's saga has exposed how vulnerable racing's data architecture can be when a savvy player treats the backstretch as one more dataset to model, and it has forced regulators and horseplayers alike to consider how transparent they really want the next generation of past performances to be.
