Former UMMC employee indicted for secretly spying on colleagues

A Maryland man is facing a federal indictment after he illegally accessed Maryland Medical System data to spy on unsuspecting co-workers for at least eight years.

Matthew Bathula, a 41-year-old man from Clarksville, was caught in the cyber voyeurism scheme by the University of Maryland Medical Center in September 2024 while working as a pharmacy clinical specialist.

Bathula has been charged with two counts of unauthorized access to a protected computer and one count of aggravated identity theft.

What happened?

After a lawsuit was filed on behalf of current and former UMMC employees, Bathula was exposed for a decade-long cyber stalking campaign, targeting nearly 200 unsuspecting victims.

The 41-year-old used keystroke software on computers to learn employees' usernames and passwords. The software granted him access to private information, including social security numbers, text messages, and nude photographs.

Bathula accessed online accounts, including Google Photos, iCloud Photos, Gmail, Microsoft 365, and social media accounts. Most of the targeted victims were women.

Various cyber intrusion techniques, such as keylogging, cookie managers, mailbox-rule creation, and file masquerading, were used, including a rule that deleted incoming emails with the subject line 'Critical Security Alert', preventing users from receiving notifications that their accounts were compromised.

In addition, Bathula used video surveillance software installed on their computers to spy on coworkers, secretly recording the victims at work and at home without their consent. According to a press release, this included watching women who were breast-pumping and engaged in intimate acts.

If Bathula is found guilty, he faces the following charges:

• 10 years in federal prison for unauthorized access to a protected computer (victims),
• five years for unauthorized access to a protected computer (victims),
• and a maximum of two years for aggravated identity theft.