The National Football League is implementing new restrictions on access to draft prospects' contact information, centralizing control over sensitive personal data following a high-profile breach involving an insider a year ago. The league's new policy limits access to this information to a single individual within each franchise, a move described by a league spokesman as ensuring the "safeguarding" of these numbers. This institutional tightening comes after a significant incident during last April's draft, where a prospect's private contact details were exposed and misused by the son of a team official.
The incident involved Shedeur Sanders, who was prank called as he experienced a significant slide down the draft board. Sanders was live-streaming a draft party with his family and friends when he received the call. The caller impersonated New Orleans Saints General Manager Mickey Loomis, just before the team's No. 40 overall pick. The Saints had been in the market for a quarterback but did not select one in the first round, eventually settling on Louisville’s Tyler Shough in the second round instead of Sanders. Sanders ultimately had to wait until the fifth round to be selected by the Cleveland Browns, who had also picked Oregon’s Dillon Gabriel in the third round the day prior.
Elite Access and Institutional Response
The prank call was made by Jax Ulbrich, the son of Atlanta Falcons defensive coordinator Jeff Ulbrich. Jax Ulbrich obtained Sanders' phone number from his father's open iPad while visiting home. This direct access to confidential data, facilitated by an elite family connection within the league, exposed the vulnerabilities of the previous system. The NFL's response, reported by The Athletic, specifies that "The relevant contact information will be provided by the league to a single point of contact at the club in football operations." This individual will then be "responsible for safeguarding the numbers," according to the league spokesman. This shift represents a consolidation of power over personal information within the league's institutional hierarchy.
Jeff Ulbrich later issued an apology for his son’s actions and accepted blame for the initial leak of the phone number. At a news conference at the Falcons' facility, Ulbrich stated, "My actions of not protecting confidential data were inexcusable." He further added, "My son's actions were absolutely inexcusable, and for that we are both deeply sorry." Ulbrich concluded by promising, "I promise my son and I will work hard to demonstrate we are better than this." The league imposed significant penalties, fining the Falcons $250,000 and docking Jeff Ulbrich $100,000 for the breach of protocol.
Centralized Control Over Individual Data
The new policy ensures that prospect contact information, once more broadly accessible, will now be under stricter, centralized control. This move by the NFL, a powerful private institution, demonstrates a pattern of tightening internal regulations in response to incidents that expose systemic weaknesses, particularly those involving individuals with privileged access. While framed as a measure to protect prospects, the outcome is a further concentration of data management power within the league's operational structure, limiting individual clubs' direct access and placing it under the purview of a single, designated point of contact. This institutional response prioritizes control and internal security following an incident that highlighted the risks of insider access to sensitive personal information.