Maryland pharmacy specialist charged with computer access and ID theft

What happened

A pharmacy clinical specialist at a Maryland medical system has been indicted on federal computer access and identity theft charges, the US Department of Justice announced on 1 May 2026.

Matthew Bathula, 41, of Clarksville, Maryland, faces two counts of unauthorised access to a protected computer and one count of aggravated identity theft. The medical system where he worked is identified in the indictment only as Company A.

According to the indictment, Bathula accessed the organisation’s computers without permission between July 2016 and September 2024, obtaining usernames, passwords, browser cookies, images, videos and other information.

Prosecutors allege that those targeted included current and former employees, people in relationships with employees or former employees, and others connected to the medical system. The alleged access extended to both professional and personal accounts.

The Department of Justice’s announcement of the indictment is the source of this report. An indictment sets out criminal accusations, not findings of guilt, and Bathula is presumed innocent unless proven guilty.

The background

The indictment describes several techniques allegedly used to obtain and retain access. These included keylogging, which captures what someone types; tools for managing browser cookies; email rules; and file masquerading, which disguises a file’s identity or purpose.

Browser cookies are small pieces of data that can help an online service recognise a signed-in user. Prosecutors say Bathula repeatedly exported victims’ cookies and imported them into another browser, allowing him to enter their accounts on other devices without permission.

That method allegedly allowed him to keep accessing accounts from personal electronic devices outside Company A’s network. The services named in the announcement include Google Photos, iCloud Photos, Gmail, Microsoft 365 and social media accounts.

The indictment also alleges that Bathula created an email rule that automatically deleted incoming messages carrying a critical security warning in their subject line. According to prosecutors, this prevented cybersecurity staff at Company A from learning that their own accounts had been compromised.

Separately, prosecutors allege that Bathula installed spyware on one or more of the medical system’s computers between February 2023 and July 2024. Spyware is software used to monitor activity without the affected person’s knowledge.

He allegedly used that software to conduct video surveillance of people at the organisation and record them without consent, including people expressing breast milk. The announcement does not identify the software or explain how the recording equipment was positioned.

Although the employer operates in healthcare, the announcement focuses on account access and surveillance of people linked to the organisation. It does not allege that Bathula accessed patient medical records or disrupted clinical services.

The case concerns a form of insider risk that reaches beyond an employer’s own files: workplace systems allegedly became a route into people’s private accounts. It also distinguishes a person’s employment role from permission to access particular computers or information; being an employee does not make every use of an organisation’s systems authorised.

A separate case involving alleged data extortion by an industrial company engineer concerned accusations that an administrator account was used to disrupt an employer’s systems. The Maryland allegations involve a different alleged purpose—surveillance—but similarly place the use of workplace technology at the centre of an insider-risk investigation.

What people are saying

Kelly O. Hayes, the US Attorney for the District of Maryland, characterised the alleged conduct as an invasion of privacy and a breach of trust towards Bathula’s employer and colleagues. She said her office and its law-enforcement partners were committed to pursuing cybercrime that harms individuals.

Jimmy Paul, the special agent in charge of the FBI’s Baltimore field office, said investigators had identified and notified all 195 victims across the country within four months. He praised the investigators’ handling of the case and said the FBI would pursue people who use technology to violate others’ privacy.

What happens next

Assistant US Attorney Thomas M. Sullivan is prosecuting the federal case. The Department of Justice announcement does not give a date for a trial or the next court appearance, and it does not include a response from Bathula or his legal representatives.

If convicted, Bathula faces a maximum of 10 years in federal prison on the computer access count involving Company A and five years on the computer access count involving victims, according to the department.

The department lists a maximum two-year sentence for aggravated identity theft. It says that sentence must run consecutively to any sentence imposed on count two, meaning it would be served after, rather than alongside, that sentence.

The statutory maximums are not a prediction of the eventual outcome. The department said federal sentences are typically below the maximum penalties, with a district judge determining the sentence after considering US sentencing guidelines and other legal factors.