A Maryland man has been indicted on charges of unauthorized computer access and aggravated identity theft related to a Maryland medical system, according to a May 1 announcement by federal authorities.
Matthew Bathula, age 41, of Clarksville, is accused of accessing protected computers without authorization while employed as a pharmacy clinical specialist at Company A, a medical system in the District of Maryland. The indictment includes two counts of unauthorized access to protected computers and one count of aggravated identity theft.
Kelly O. Hayes, U.S. Attorney for the District of Maryland, said: “Bathula’s alleged actions are a reprehensible invasion of privacy. He betrayed the trust of his employer and co-workers, as he gained access into the private worlds of nearly 200 victims without their knowledge or consent. We, along with our law-enforcement partners, are committed to holding individuals accountable who commit cybersecurity crimes, thereby harming unsuspecting people.”
Special Agent in Charge Jimmy Paul from the FBI Baltimore Field Office added: “Matthew Bathula is accused of weaponizing technology to spy on hundreds of unsuspecting victims for eight years. I am proud of the swift and thorough response by FBI Baltimore’s team… They worked diligently to identify and notify each of the 195 victims… in just four months. The FBI will always investigate, pursue, and hold accountable those who hide behind screens and keyboards to exploit and violate the privacy of others.”
According to court documents, between July 2016 and September 2024 Bathula allegedly used cyber intrusion techniques such as keylogging software and mailbox-rule creation to gain access not only to work accounts but also personal online services like Google Photos or iCloud Photos belonging to current or former employees or affiliates. He reportedly created mailbox rules that deleted critical security alert emails so cybersecurity staff would not be aware their accounts were compromised.
Authorities allege that between February 2023 through July 2024 Bathula installed spyware on company computers enabling him to conduct video surveillance—including recording people engaged in breast pumping—without their consent.
If convicted on all charges Bathula faces up to ten years in prison for one count relating specifically to Company A’s systems; five years for another count concerning individual victims; plus an additional two-year mandatory sentence if found guilty on aggravated identity theft. Sentences will be determined by a federal judge considering sentencing guidelines.
The U.S. Attorney for the District of Maryland employs over 200 personnel across its civil, criminal and administrative divisions according to its official website. The office serves nearly six million residents across Maryland according to its official website as part of the U.S. Department of Justice according to its official website. It prosecutes federal crimes including cases like this one involving cybercrime according to its official website, handles civil cases for the government according to its official website, collects government debts according to its official website, enhances quality-of-life through justice administration according to its official website, counts alumni in prominent leadership roles according to its official website, partners with law enforcement agencies for public safety protection—and traces origins back more than two centuries.
U.S. Attorney Hayes commended both FBI investigators’ efforts identifying all known victims within months as well as Assistant U.S. Attorney Thomas M. Sullivan who is prosecuting this case.
