A pharmacist at the University of Maryland Medical Center (UMMC) has been caught using the organisation’s IT systems to spy on female clinicians using webcams at their offices and homes. Grant and Eisenhofer attorney Steve Kelly, on behalf of six unnamed plaintiffs, has filed a civil lawsuit against the accused in a Baltimore circuit court.
The complaint alleges that the now-former pharmacist Matthew Bathula installed spyware on at least 400 computers in clinics, treatment rooms, labs, and several other locations for nearly a decade. To make matters worse, it’s also alleged that he installed keyloggers on UMMC computers to capture the credentials of personal accounts not connected to the university.
Cameras connected to these infected PCs and home security systems were then used to watch the plaintiffs breastfeeding, being intimate with their partners, and more. Bathula also accessed his coworkers’ “personal photo libraries and captured, downloaded, and retained their intimate photographs and personally-identifiable information.”
Interestingly, the complaint targets UMMC instead of Bathula, claiming that the organisation failed to conduct proper investigations to detect and stop the use of keylogging software on hospital systems, despite security firm Crowdstrike being one of its vendors. The hospital also did not comply with the Health Information Technology for Economic and Clinical Health Act, failing to inform the victims of a security breach and not putting appropriate safeguards in place to limit the installation of software and hardware devices to system administrators, among other preventive measures detailed in the act.
The lawsuit does claim that the hospital sent out a mass email on October 1, 2024, informing the staff about a “serious IT incident that may have impacted patients and team members at the University of Maryland Medical Center Downtown Campus.” The email claimed to have discovered a “highly sophisticated and very difficult to detect cyberattack” that resulted in data theft but did not notify employees whether their data was accessed or if they were being spied upon. Victims reportedly only learned of the illegal activity once contacted by the FBI running its investigation.
Following this notification, UMMC put Bathula on administrative leave and later terminated his employment. However, his Maryland State Board of Pharmacy license is reportedly still active. The hospital also issued a statement saying it’s “deeply disappointed and angered at the actions of the individual at the center of this criminal investigation.”
In the News: Adobe patches over 30 vulnerabilities in its software suite, 11 critical
