Cyber Incident Victim: Hudl
Date:
May 2018
Location:
United States of America
Summary
A high school football team improperly accessed opponents' game and practice videos through a college recruiting account on the Hudl video platform, violating service terms. The platform revoked all access upon discovering the misuse during an investigation prompted by a tip to the school district. Hudl alerted affected parties but did not disclose preventive measures or frequency of such incidents. The school administration conducted its own review and claimed to take appropriate disciplinary action against staff, though specifics weren't shared due to district privacy policies. The impacted opponents included teams the school had both defeated and lost to during competitive play.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In July 2018, Braden River High School's football coaching staff in Bradenton, Florida, was found to have improperly accessed opponents' game and practice videos through the Hudl video hosting platform. The team, nicknamed the Pirates, had finished the previous season with a 9-2 record and advanced to the second round of Florida's 7A state playoffs. An investigation initiated by Hudl revealed that coaches used a college recruiting account login credential—not specifically named in reports—to view footage belonging to Venice High School, which had eliminated Braden River from the playoffs and ultimately won the state championship. The unauthorized access also extended to three other opponents Braden River defeated during the season: Booker High School (Sarasota), North Port High School, and Sarasota High School. Hudl became aware of the violation through a tip submitted to the Sarasota County School District in May 2018, prompting both the platform and school district to launch separate inquiries.
Hudl terminated all access privileges for the compromised account upon confirming the breach and notified affected parties, though the company declined to specify its standard account security controls or prevalence of similar incidents. In a public statement, Hudl emphasized user privacy as a priority and expressed disappointment over the terms-of-service violation. Sarasota County Superintendent Todd Bowden reviewed the matter following the initial report, while Braden River Athletics Director Matt Nesser confirmed the school administration had investigated and taken unspecified "appropriate action" against staff members involved. Nesser cited district policy prohibiting disclosure of employee disciplinary measures, leaving the nature of sanctions against the coaching staff unconfirmed. The incident raised questions about competitive integrity in high school athletics but yielded no public documentation of competitive penalties against the Braden River football program or adjustments to game outcomes.