Loading story…
Federal prosecutors in Maryland indicted former hospital pharmacist Matthew Bathula over an alleged eight-year campaign of unauthorized computer access tied to a Maryland medical system, identified in court records as Company A and reported to be the University of Maryland Medical Center. Investigators allege Bathula abused his role as a pharmacy clinical specialist from July 2016 through September 2024 to steal usernames, passwords, authentication cookies, images, videos, and other sensitive data from nearly 200 victims connected to the health system.
According to the indictment, Bathula used keyloggers, cookie theft tools, mailbox rules, file masquerading, and later spyware to maintain covert access to employee and affiliate accounts, including Gmail, Microsoft 365, Google Photos, iCloud Photos, social media, dating apps, and home security systems. Prosecutors say the activity enabled prolonged surveillance and, between February 2023 and July 2024, included covert video recording of victims without consent; the FBI said it identified and notified 195 victims nationwide within four months. Bathula faces two counts of unauthorized access to a protected computer and one count of aggravated identity theft, with potential prison exposure of up to 17 years, while civil lawsuits by current and former employees allege negligence, negligent supervision, negligent security, and invasion of privacy.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
The case prompted civil litigation by at least six current and former employees alleging negligence, negligent supervision, negligent security, and invasion of privacy. The reference does not provide a specific filing date for those lawsuits.
On May 1, 2026, federal prosecutors in Maryland announced the indictment of Matthew Bathula on two counts of unauthorized access to a protected computer and one count of aggravated identity theft. If convicted, he faces up to 17 years in prison across the charged counts.
The FBI Baltimore Field Office said investigators identified and notified 195 victims located across the United States within four months. The references do not specify the exact start date of that notification effort.
The indictment says the unauthorized access and cyber spying campaign continued until September 2024. Over the course of the scheme, nearly 200 victims were allegedly affected through credential theft, mailbox-rule abuse, cookie theft, file masquerading, and other techniques.
Prosecutors allege that from February 2023 through July 2024, Bathula installed spyware on Company A computers to conduct covert surveillance. The alleged activity included recording victims without their consent and accessing highly private footage through compromised systems and accounts.
According to the indictment, Matthew Bathula began abusing his position as a pharmacy clinical specialist to gain unauthorized access to protected computers at a Maryland medical system identified as Company A. Prosecutors say the activity started in July 2016 and was used to steal credentials and other sensitive data from employees and affiliates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included **AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander,** and **LendingTree**, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers. Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least **79.7%** of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s **SnowSight** web interface, the **SnowSQL** CLI, **DBeaver Ultimate**, and a reconnaissance utility tracked as **FROSTBITE** to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than **$2.5 million** in ransom payments, while Moucka separately made about **$495,000** selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Aug 8, 2026
Former Saydel Community School District IT employee **Ezekiel Dean Potter** was sentenced to **21 months in prison** after prosecutors said he carried out a prolonged cyber sabotage campaign against the Iowa district following his April 2023 termination. Authorities said Potter kept access to more than 300 district credentials and, from May 2023 through January 2025, used them to delete accounts, take down the district’s Facebook page, interfere with **Apple School Manager**, target **GoDaddy**, and compromise **Google/Gmail**, **PowerSchool Schoology**, and other school services. The intrusions locked teachers out of platforms, disrupted classrooms, and caused tens of thousands of dollars in losses, with reported direct costs exceeding **$73,000** and restitution set at **$59,668.81**. Investigators tied the activity to Potter through forensic evidence including IP addresses linked to later employers, activity traced despite VPN use, and a USB drive containing spreadsheets of district usernames and passwords. Potter pleaded guilty in January 2026 to computer fraud charges under the **Computer Fraud and Abuse Act** and was also ordered to serve supervised release with computer-use monitoring conditions.
Jun 29, 2026
U.S. prosecutors charged **Kwamaine Jerell Ford**, a 34-year-old Georgia man, with running a long-term social-engineering and account-takeover scheme that targeted **NBA and NFL players** by stealing their **Apple/iCloud credentials** and, in some cases, **multifactor authentication codes**. According to the indictment described by multiple reports, Ford allegedly impersonated a well-known adult film actress on social media to lure athletes into sharing access to their accounts, then used stolen financial and personal data to conduct unauthorized purchases and other fraud. Authorities say the activity ran from **November 2020 through September 2024**, involved more than **2,000 unauthorized transactions**, and led to charges including wire fraud, computer fraud, access device fraud, aggravated identity theft, and sex trafficking; Ford has pleaded **not guilty** and is being held without bail. The case is notable because prosecutors say Ford resumed similar criminal activity while still serving a sentence for an earlier phishing campaign that had also targeted athletes and celebrities. One report says evidence from seized devices showed he began phishing professional athletes again within days of being released to home confinement during the pandemic, while another says some of the alleged conduct occurred while he was still in federal prison. Prosecutors also allege the scheme escalated beyond financial theft: Ford is accused of coercing a woman into sexual encounters with several players, recording hidden videos, and hacking at least one victim's home security cameras. The reporting consistently portrays the operation as a repeat-offender **credential theft and fraud campaign** centered on compromised Apple accounts and social-engineering of high-profile sports figures.
Jun 29, 2026