Cyber Firm CEO Accused of Placing Malware on Hospital Device

The CEO of a small cybersecurity firm is facing two counts of violating Oklahoma’s Computer Crimes Act in a case alleging that he walked into an Oklahoma City hospital and installed malware on employee computers.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Jeffrey Bowie, whose LinkedIn profile says he is CEO of Oklahoma City-based Veritaco, a “cybersecurity and private intelligence” firm, was arrested on April 14 and faces two counts of violating Oklahoma’s Computer Crimes Act in an incident on Aug. 6, 2024.

Local news outlet KOKO News 5 said a staff member of St. Anthony Hospital in Oklahoma City reported seeing Bowie access an employee’s computer.

Security camera footage apparently shows Bowie wandering around the hospital last August trying to enter multiple offices until he stumbled on two computers, in which he allegedly installed malware designed to take a screenshot every 20 minutes and to send the images to an outside IP address, according to local media outlet News 9.

The Oklahoma City police department referred Information Security Media Group to the FBI for further comment about the case. The FBI did not immediately respond to ISMG’s request for comment.

St. Anthony Hospital, a 773-bed tertiary care hospital, is part of the SSM Health, a Catholic, not-for-profit health system with facilities in Oklahoma, Missouri, Illinois and Wisconsin.

In a statement provided to ISMG, SSM Health said that no patient information was affected by the incident. SSM Health did not immediately respond to ISMG’s request for comment on whether Bowie had any business or personal ties to St. Anthony Hospital.

Bowie’s LinkedIn profile describes his firm Veritaco as a cybersecurity, digital forensics and private intelligence firm “focused on delivering top-class services” and employing two to 10 employees.

As of Monday, Veritaco’s website appeared to be offline. A man answering the phone at Veritaco told ISMG he would relay a message for Bowie to respond to ISMG’s request for comment on the case, but Bowie did not immediately reply.

While the relationship – if any – between Bowie and St. Anthony Hospital – has not yet been publicly disclosed, the case also came to light on the heels of at least two recent incidents involving malicious hospital insiders.

That includes a case involving a physical therapist accused of using his credentials to access plastic surgery patients’ sensitive medical records and clinical photos at a non-affiliated hospital, and a separate case involving a hospital pharmacist accused of installing spyware on computers to snoop on colleagues in their homes and at work for a decade.

“People who engage in this type of behavior are ‘motivated’ by greed, fear, sex or a mental condition such as narcissism. These four items explain a lot,” said regulatory attorney Rachel Rose.

Organizations need to have adequate technical safeguards in place to detect malware that is deployed – whether from an internal threat actor or an external threat actor, she said.

“This goes back to the basics of conducting an annual risk analysis, mking sure the organization knows how long their camera footage is stored for before it is written over and ensuring that the footage … is actually reviewed and retained,” she said.