Hospital Pharmacist Spied on Coworkers for a Decade

The University of Maryland Medical Center is facing a class action lawsuit that alleges one of its pharmacists installed keylogging software on 400 laptops and workstations over a decade to spy on the personal lives and intimate moments of at least 80 coworkers.

See Also: A Modern Approach to Data Security

Attorneys say UMMC pharmacist Matthew Bathula used the stolen credentials to access personal information and secretly record coworkers in their homes and throughout the workplace, according to a lawsuit filed last week in a Baltimore court. The university said the pharmacist was fired and is under a criminal investigation by federal law enforcement.

Attorneys representing the plaintiffs allege that Bathula installed keylogging software on hundreds of computers and workstations in clinics, treatment rooms, labs and a variety of other locations throughout the academic medical institution’s campus. Bathula then obtained coworkers’ usernames and passwords for their personal accounts, including bank accounts, email, home surveillance systems, Drop Box accounts, Google Drives, dating applications, Google Nests and iCloud accounts.

“Bathula captured and retained lists of Medical Center employees’ login credentials. He used that information to then access the personal accounts of his coworkers,” the lawsuit alleges.

“Once inside those accounts, he downloaded and retained Medical Center employees’ private photographs, videos and personally identifying information. He also surveilled Medical Center employees in real-time in the privacy of their own homes and captured and recorded private and intimate moments with their spouses and families,” the lawsuit alleges.

Bathula also allegedly used these login credentials to gain remote access to webcams to record videos of young doctors and medical residents in private moments at work, such as when UMMC coworkers who were new mothers pumped breastmilk in closed treatment rooms.

UMMC in a statement to Information Security Media Group said it cannot comment on the specific allegations in the lawsuit due to the ongoing litigation against the medical center and the criminal investigation into Bathula by law enforcement.

“Our organization notified team members of a serious IT-related security threat in October 2024, and immediately contacted the FBI,” UMMC told ISMG.

“Mr. Bathula was terminated immediately thereafter. Because this is an FBI investigation, that agency has been leading the communications/interviews with impacted team members. Of note, we do not have access to any of the information that the FBI has uncovered in the course of their investigation,” UMMC said.

The hospital said it has beefed up security since the incident. “We employ a large and highly capable team to help keep our environment secure, and we partner with dozens of world-class partners and vendors to further strengthen our infrastructure. Additionally, in response to this incident, we have increased surveillance across our network to better detect unauthorized access,” UMMC said.

Cindy Morgan, an attorney at the law firm Grant & Eisenhofer P.A., which is representing the plaintiffs in the lawsuit, told ISMG that her clients do not know how or when UMMC became aware of the alleged misconduct, but it could have been years ago.

“Our complaint details statements made by IT personnel that show UMMC’s knowledge may extend several years back. In an Oct. 1, 2024 correspondence to their current employees, UMMC said that they had been investigating the cyberattack ‘over the last number of weeks,'” she said.

“A privacy invasion of this magnitude, which compromised hundreds of different computers, would not have occurred without UMMC failing to take any reasonable and available data security measures for the better part of a decade,” Morgan alleges.

Those measures include restricting user permissions, disabling USB devices, installing USB data blockers and keystroke encryption software, employing robust firewalls and conducting regular IT security audits, she said.

“Because UMMC failed in every aspect of data security, the offender was allegedly able to install keystroking software on hundreds of computers, which he then used to access UMMC employees’ and workers’ private and personal photo storage accounts and home surveillance systems,” she alleges.

Bathula captured and retained intimate photos and surveilled his coworkers and their families – including minor children – in the privacy of their homes, she alleged.

“The scope and scale of the offender’s cyberstalking attack is unprecedented. It could not have occurred without negligible conduct on the part of the institution.”

The FBI declined ISMG’s request for comment, saying it “cannot confirm or deny any particular contact or the potential existence of an investigation.”

The Maryland Board of Pharmacy in a statement to ISMG also said it cannot comment specifically on the UMMC matter. “In general, the Board of Pharmacy receives and investigates complaints against pharmacists, pharmacy technicians, pharmacy interns, pharmacies and wholesale distributors,” the state spokesperson said.

“The board’s investigations are confidential, and therefore, we are unable to share any information regarding pending investigations. However, once an investigation is completed, the board may decide to pursue formal disciplinary action against a licensee, which would ultimately result in a formal order,” the spokesperson said.

Formal orders are public documents, but the process could take several months, depending on the circumstances of the case, the spokesperson said.

Bathula has so far not responded to ISMG’s request for comment about the allegations.

Egregious Allegations

Some experts said the privacy and security allegations in the case are extremely concerning.

“This is one of the most egregious cybersecurity cases I’ve ever seen and demonstrates that the risks in this area aren’t just limited to financial harm but extend to the most intimate areas of our lives,” said former federal prosecutor Andrew Wirmani, an attorney at the law firm Reese Marketos LLP, which is not involved in the UMMC lawsuit.

“In an era where virtually all of our personal information – messages, pictures, etc. – is stored electronically, one bad actor has the ability to wreak havoc on the lives of hundreds of people.”

Regulatory attorney Rachel Rose, who is also not involved in the UMMC case, offered a similar perspective, saying the allegations are highly disturbing.

“The activity crossed over into accessing personal spaces and personal accounts, not just those that were limited to the hospital; the sensitive and/or sexual nature of the conduct being filmed; and the length of time that the malware went undetected,” she said.

“As for the 10 years that this individual was allegedly engaged in this conduct, it is perplexing that no third-party risk analysis or penetration test discovered it.”

Rose said that based on the lengthy time during which the misconduct allegedly took place, “from my perspective the required technical, administrative and physical safeguards were woefully deficient” at UMMC.

“There is no reasonable explanation because if there were adequate technical safeguards, an annual risk analysis and penetration tests being done, it would have been identified,” she said. “Moreover, the conduct also violates the Stored Communications Act and other federal laws, even though the class action did not name those. The SCA provides a private right of action, as well as a criminal path for government lawyers to pursue.”

Wirmani said that while he is not privy to details of UMMC’s security program, other healthcare organizations should take notice of the potential weaknesses that are spotlighted by the case.

“When hospitals face the potential for external actors to gain access to their systems and potentially compromise patient safety, it’s easy to see how those threats might take precedence and allow these types of ‘Trojan Horse’ situations,” he said.

“Cybersecurity should start with ensuring that those that have authorized access to systems are fully vetted and monitored. Background checks and similar vetting can go a long way.”

The healthcare sector faces heightened cybersecurity requirements because of the sensitive, confidential and HIPAA-protected data that they store, said Morgan, the plaintiffs’ attorney.

“Those entities should be adhering to all statutory requirements and, as a whole, be taking all reasonably available measures to ensure the safety of their employees’ data and that of their patients,” she said.