In the fall of 2002, a computer programmer named Chris Harn sat at his desk at Autotote in Delaware and showed this industry exactly what one man with a legitimate login could do to it. He didn’t break into anything. He didn’t have to. He had authorized access to a system with a gap in it, and he used that gap to rig the Pick Six on the biggest racing day of the year.

We apparently learned nothing.

There is a version of the past ten days that we all expected. Saratoga in full stride, the Travers and the Pacific Classic both on the horizon, yearlings changing hands for seven figures at Fasig-Tipton. That is the racing we should be talking about.

Instead, we are discussing a betting coup executed through betting shops in England, and about a man with an authorized login who spent at least six weeks pulling horse health records the rest of us were never allowed to see.

But this is where are in the Sport of Kings. The customer has the right to believe the game is straight, that everyone is competing on a level playing field, and too many of us know better.

The Fair Hill Five

Start with Sunday, August 9. Five horses that had all been showing published workouts at the Fair Hill Training Center in Maryland turned up in races at Monmouth Park and Saratoga. Every one of them was coming off a long layoff. Four of them won.

At Monmouth, The Great Amira went off at over 17-1 and won by nine lengths. She had finished last in both of her previous starts and hadn’t been seen since February. One race later, her stablemate Tepeyac won by a half length at 3.8-1. Both were trained by Angel Quiroz.

Up at Saratoga, Classic Rock and M Bs Melanie Cares won for Ernesto Ochoa, listed as both owner and trainer — two horses Quiroz has acknowledged training until their owners sold them to Ochoa shortly before those starts. Quiroz’s fifth runner, Scootaloo, broke poorly at Saratoga and finished fourth.

Going into that Sunday, Quiroz had won two races all year. Ochoa had also won two. Between them they went four-for-five in an afternoon.

Any handicapper worth the price of a program can look at that sequence and feel something is off. Form reversals happen. Layoff horses win. Barns get hot. But four of them in one afternoon, out of the same training center, all off long breaks, all showing modest published works? That’s an epic betting coup, well executed to the detriment of the betting public.

The tell wasn’t the win prices. Those were roughly in line with the morning line. It was the daily double. The Great Amira paid $37.20 and Tepeyac paid $9.60. A $2 parlay of those two prices returns $178.56. The double paid $25.60.

Horse Racing Nation went back through the records to 1998 and found more than a thousand doubles with win prices in that same range. This one paid about 14 percent of the parlay. The worst previous ratio they could find was 31 percent. The median double actually pays better than the parlay, because it carries a single takeout instead of two. In other words, this was the worst-paying double relative to its win odds in at least twenty-eight years of American racing. Somebody hammered that combination hard enough to flatten the pool — on horses the past performances said had no business winning.

The real money, though, wasn’t in the American pools at all. It was in Britain, where bookmakers take fixed odds on American racing and where a bet, once struck, doesn’t move the price the way a mutuel pool does. According to the Racing Post, the operation worked the retail shops in cash, and it wasn’t confined to the five horses at Monmouth and Saratoga.

A sixth runner was live: Winston Wolf in the fourth at Colonial, entered under trainer Alexis Cordero-Lopez, who had made his previous start for Quiroz and had two workouts showing at Fair Hill.

Paddy Power’s Paul Binfield told the Racing Post they saw the business landing in their UK shops in real time, called it a remarkable attempted gamble unlike anything they’d seen, and acknowledged they were fortunate it only came in four-for-six. Reported bookmaker losses run into six figures.

HISA and HIWU are both investigating. Quiroz has denied that anything improper happened, telling Thoroughbred Daily News in substance that he ran his horses, they won, and he doesn’t see the problem. He is entitled to that defense and entitled to due process.

Then on August 13, HIWU charged him with an albuterol positive carrying a possible two-year ban. The sample came from a filly named Bonita Rough, taken after a half-mile breeze at Fair Hill on July 10 — a workout she was doing in order to get herself off the vet’s list.

Nothing about the coup has been proven. Whoever structured this did not need to fix a race. They only needed to know something about the condition of five horses that nobody could learn from the published record.

Professor Marshall Gramm

The dust had barely settled on the first story, when another major scandal arrived Monday afternoon.

HISA has charged Marshall Gramm — the Rhodes College economics professor, prominent owner through Ten Strike Racing, longtime contest player and member of The Jockey Club — with multiple rule violations, fraud among them, arising from unauthorized access to confidential horse health information.

Here is what HISA says happened. Back in June, custom past performances for two horses, Deterministic and Griffin’s Wharf, showed up on social media carrying confidential health data that only those horses’ connections and regulatory veterinarians were supposed to see.

HISA investigated, brought in outside forensic analysts, and concluded that Gramm had spent roughly six weeks, from early May into mid-June, systematically pulling that data out of the HISA portal. According to HISA, he built an automated method to harvest it at scale, structured in a way meant to look like ordinary authorized use so the security systems wouldn’t flag it. Confronted with the findings, he acknowledged being the source of those two sets of past performances.

And during that same six-week stretch, per HISA, he played handicapping contests, bet into the pari-mutuel pools, and claimed horses across multiple jurisdictions. HISA says it will pursue restitution for the affected parties and hand its findings to law enforcement and the state commissions.

Gramm is contesting the charges and has said he intends to defend himself. His account is that the data sat inside his own authorized account, that he used his own credentials, that he circumvented no security protocol to reach it, and that he hadn’t fully grasped the scope of what the dataset contained when he pulled it.

He says his real failure was not flagging the vulnerability to HISA once the story went public, and he has apologized for that. He also argues that making him the story distracts from the access-control weaknesses that let the information sit there in the first place.

Here is another truth that is difficult to swallow. HISA built a system that allowed a credentialed user to vacuum up confidential health data on horses he had no connection to, at volume, for six weeks, without tripping an alarm. That is a real failure and it deserves its own reckoning. The industry should not let that get buried under the personality of the case.

Regardless, it doesn’t get Gramm off the hook.

I have spent a long time in the tournament world. I know what it takes to get to the NHC — the qualifying, the travel, the months of work, the small edges you scratch out from watching replays until your eyes hurt. The hope is that everybody in that room is playing the same game with access to the same information. We can continue to hope.

If HISA’s account holds up, players participated in recent contests alongside somebody who knew which horses had been treated for what, and when. Not through better handicapping. Through a database that none of us had access to.

According to Barstool Sports, Gramm finished second in NYRA’s Belmont Stakes Day handicapping event, winning $37,000 in prize winnings plus a $10,000 Breeders’ Cup Betting Challenge Seat. Yes, it took place during the six-week window Gramm had access to the vet records.

You can argue about intent. You can argue about whether the door was locked or merely closed. You cannot argue about what a horseplayer who finished one spot behind him is entitled to feel this week.

The Same Disease

Horse racing is not a sport that people bet on. It is a sport that exists because people bet on it. Strip out the handle and there is no purse structure, no breeding market, no Saratoga, no Del Mar. Every dollar of it flows from somebody who sat down with a program and decided the puzzle was solvable and worth attempting.

That decision rests on one assumption: that the gap between the sharpest player and the connections is a gap of skill and work, not a chasm of private and exclusive access. A good handicapper accepts that the trainer knows more than he does. That’s fine. That’s part of the game. What he cannot accept is that somebody else is holding the answer key.

Two coups inside two weeks, one financial and one informational, both built on knowing something structural that the paying customer was never permitted to know. That is not a run of bad luck for the horse racing industry. That is a system with the wrong incentives running through it, and it has been that way a long time. Will it ever change?

I went to school to work in the Thoroughbred racing industry and did so for thirty years. And I’ll tell you what I think about most weeks like this one: I’m relieved I no longer need this business to pay my mortgage. That is not a thing a person should feel about a sport he loves, and the fact that I feel it should worry the people running it a great deal more than it worries me.

What Has to Change

I write this article because I’ve spent my life in this game and I would like there to be a game left. But things have to change.

Publish the vet’s list data. All of it. In real time. The instinct after a leak is to lock things down harder, and that instinct is wrong here. If information about a horse’s soundness is valuable enough that people are apparently misusing it to bet, then it is valuable enough that the betting public is entitled to it. Every horseplayer should see the same file at the same moment. Restricting it further just shrinks the circle of people holding the edge.

Conflict-of-interest rules with teeth. Anyone with access to non-public regulatory or health data — board members, club members, officials, software vendors, their families and their partners — should be barred from wagering into pools where that data matters, and should have to certify it annually in writing with real consequences for lying. This is not a novel idea. Every securities exchange in America runs on it.

Contest integrity standards. Tournament operators need eligibility rules covering exactly this scenario, and they need them now, not after the next BCBC or NHC.

Audit logging that actually works. HISA’s forensic review found the activity after the fact, which is better than nothing. But six weeks of automated harvesting should have set off an alarm somewhere around week one.

Honest reckoning with the fixed-odds exposure abroad. If our racing is offered at fixed odds overseas while our own integrity apparatus has no visibility into that action, we are making a mistake.

This is Where We Are

We got lucky twice, in a narrow sense. British bookmakers noticed the betting and said something. Sharp observers on social media flagged the double payout within minutes and asked hard questions about those past performances until somebody had to answer them.

Which brings me back to Chris Harn, and to the part of that story most people have forgotten. The Breeders’ Cup was not his first attempt. He and his crew had already run the identical play twice in the weeks before — a Pick 4 at Balmoral, a Pick 6 at Belmont two days later. Both worked. Nobody noticed either one. Investigators only found them later, working backward. Sound familiar?

What sank Harn at Arlington was luck, and not his own. Volponi won the Classic at 43-1, which left the group as the sole winner of a $3 million jackpot on a ticket whose structure audited itself. Had other legitimate tickets hit that afternoon, the pool splits, the bet goes unnoticed, and Harn goes back to his desk on Monday morning.

The question that ought to concern all of us is how many times nobody noticed at all.