Maryland Man Accused of Eight-Year Scheme Involving Unauthorized Access to Medical System and Identity Theft

A federal indictment has been unsealed against a Maryland man accused of engaging in a prolonged scheme of unauthorized computer access, which allegedly targeted a local medical system and compromised the personal information of nearly 200 individuals. The charges, brought forth by the U.S. Attorney’s Office for the District of Maryland and the FBI Baltimore Field Office, detail a series of alleged intrusions that spanned from 2016 to 2024, impacting current and former employees, as well as their affiliates.

The indictment charges Matthew Bathula, 41, of Clarksville, Maryland, with two counts of unauthorized access to a protected computer and one count of aggravated identity theft. According to the charges, Bathula, while employed as a pharmacy clinical specialist for a medical system identified as Company A, allegedly accessed protected computers without authorization. This alleged access allowed him to obtain sensitive data, including usernames, passwords, cookies, images, and videos, from the victims.

Investigators allege that Bathula employed various sophisticated cyber intrusion techniques to gain access to personal and professional accounts. These methods are said to have included keylogging, the manipulation of browser cookies, the creation of hidden mailbox rules, and file masquerading. These actions purportedly enabled him to access online services such as Google Photos, iCloud Photos, Gmail, and Microsoft 365, as well as social media accounts belonging to individuals connected with Company A. Furthermore, it is alleged that a specific mailbox rule was established to automatically delete incoming emails with the subject line “Critical Security Alert,” a tactic intended to evade detection by the company’s cybersecurity personnel.

The indictment further details how Bathula allegedly exported browser cookies, which allowed him to import them into his own internet browser. This practice is believed to have enabled him to maintain unauthorized access to victims’ accounts on his personal devices, even when he was located outside of Company A’s network. The alleged scheme intensified between February 2023 and July 2024, when Bathula is accused of installing spyware software on Company A’s computers. This software allegedly facilitated unauthorized video surveillance of individuals present at the company, including the recording of people engaged in activities like breast pumping, all without their knowledge or consent.

If convicted, Bathula faces significant penalties. The charges for unauthorized access to a protected computer carry potential prison sentences of up to 10 years for the access related to Company A’s systems and up to five years for the access related to victims’ data. The aggravated identity theft charge carries a mandatory two-year consecutive sentence. However, actual sentences in federal cases are typically determined by a federal district judge, who considers the U.S. Sentencing Guidelines and other statutory factors.

The investigation was a collaborative effort, with U.S. Attorney Kelly O. Hayes and FBI Baltimore Field Office Special Agent in Charge Jimmy Paul commending the work of the investigative team. The FBI reportedly worked diligently to identify and notify all 195 alleged victims, who are located across the country, within a four-month period. The U.S. Attorney’s Office noted that an indictment is an accusation and individuals charged are presumed innocent until proven guilty in a court of law.

Article by Mel Anara, based upon information from the U.S. Attorney’s Office, District of Maryland

---