‘He’s been watching me this whole time’

When the FBI came to her house with the photos, she tried to make light of it all.

The agents in dark suits reminded her of Mulder and Scully from “The X-Files.” This was some ridiculous scene, right? It couldn’t be real.

They sat at her dining table and opened the folder to an image from her Bumble dating app. They showed her a suggestive picture that she had sent a long-ago boyfriend. She started to cry when they turned to a picture of her breastfeeding her daughter. Oh, my God —

How did the voyeur get a picture from inside her home?

Her eyes went to the security camera across the room. She alone had the login credentials to turn on the camera after she left for work as a hospital pharmacist. She had never thought to check the history. Now she found more than a dozen remote and unauthorized logins stretching back two years.

The thought was a drumbeat in her mind:

He’s been watching me this whole time.

She wasn’t alone. The FBI recovered intimate photos of doctors, nurses and pharmacists at one of the country’s premier teaching hospitals, the University of Maryland Medical Center in Baltimore. The stolen photos ranged from simple passport pictures to images of the women undressed at home and pumping breast milk in the hospital exam rooms.

Someone had rummaged through their Google photos and emails for keywords such as “sex.” The FBI put the number of victims at almost 200. Several of these women made a discovery even more frightening — the hacker had secretly taken over their home security cameras to spy on them.

The investigation led to Matthew Bathula, a 41-year-old pharmacist who had sweeping access to the computers at work. He was fired in October 2024. Eight months later, in June 2025, state regulators suspended his pharmacy license. A federal grand jury indicted him this month on felony computer crimes and identity theft. He has pleaded not guilty.

And the women are suing the university medical system and hospital, accusing administrators of negligence in failing to detect and stop Bathula’s alleged yearslong campaign of cybervoyeurism. Hospital attorneys argue the institutions aren’t liable for Bathula’s alleged crimes. The courts granted the plaintiffs anonymity.

Seven women spoke to The Banner on the condition that their names would not be published because of the sexual nature of the case. Those women described feeling violated, guilty and ashamed. The hospital pharmacist is identified in this story as Jane Doe A.

The women are pissed off, too. They already felt like their bosses downplayed the alleged crimes as merely a data breach. Worse yet, federal prosecutors took more than a year to get an indictment with no explanation for the delay. The women felt brushed off.

“I want people to care because otherwise he gets away with it,” Jane Doe A said.

One of his quirks

In his 13 years at the hospital, Bathula came across as a smart and committed pharmacist, if somewhat eccentric.

He worked in the anticoagulation clinic for patients at risk of blood clots and strokes, where he was known to sign emails as “director.” The medical system maintains he did not hold that title.

A clinical pharmacist, he also made rounds with internal medicine teams to review medications and manage doses for patients throughout the 789-bed hospital near Camden Yards.

He had started work at the University of Maryland Medical Center in July 2011. Seven years later, he married and eventually settled in Clarksville to raise a family.

With his neckties and gelled hair, Bathula could seem stuffy and formal to colleagues. He lived off chili dogs and Lipton Brisk iced tea, and he was always popping up in unexpected places.

“He would roam the hospital. It was strange, like one of his quirks,” Jane Doe A said. “Because he was so highly regarded, he was given kudos for that. ‘Oh, he’s so dedicated to his clinic patients, he’s going there and there to check on them.’”

Jane Doe B worked as a nurse on the locked 10th floor of the hospital. Bathula was not assigned to her unit, but he was still a familiar sight at the computers when she came in. She figured he was visiting the pharmacists or auditing the medicine supplies.

“I would look over my shoulder in the morning and he would be there,” she said. “People knew him. He looked busy, like he was supposed to be there.”

To pharmacy residents in training, Bathula was proficient in clinical knowledge, approachable yet not overbearing, challenging but letting them find their way to an answer. When a resident seemed lost, he might invite her to meet at the soft-serve ice cream machine for a pep talk.

He stored instructional materials on Google Drive, so the women signed into their personal Gmail accounts on the hospital computers. They paid this no mind. Bathula was just a dependable, unassuming fixture of a busy clinic.

“He wasn’t terribly memorable,” said Jane Doe C, a doctor.

In October 2024, however, something unexpected happened: He didn’t show for rounds.

On rare occasions, an attending pharmacist will call out and arrange for a sub. They might handle rounds remotely, by Zoom or phone. But an attending never simply “no-showed.”

Their text messages to Bathula went unanswered. One of the women tried his wife, too.

Something was terribly wrong. Soon, hospital administrators announced a vague “cyber incident,” and unfamiliar men in suits showed up to Bathula’s workstation.

They carried off his computer.

‘Do you recognize this man?’

With scant information from the hospital higher-ups, rumors swirled among the staff about cyber-ransoms and hackers stealing patient information. What happened to Matt Bathula?

Weeks passed, and he didn’t return to work. By December 2024, the women — doctors, pharmacists, nurses, social workers — were getting calls from the FBI. Agents wanted to meet them at their homes or coffee shops to identify some photos.

“I’m not interesting enough for this,” Jane Doe D, a doctor, remembered telling herself.

The doctor hadn’t worked with Bathula daily in years. Now, two agents and someone called a “victim specialist” had a batch of photos for her to identify.

The first was simply a cute picture from a hospital party on her Instagram. Then, one of her breastfeeding her newborn daughter. That photo was from her cellphone and showed her from her breast down to her daughter.

Next came pictures she had taken of her passport and driver’s license. The last photo was puzzling. It looked like two people having sex. Who was that? Suddenly she recognized her old apartment.

“I immediately felt guilty and shameful,” she said.

She remembered taking a single photo with her husband more than a decade ago during a moment of intimacy. She had assumed it was deleted and forgotten it. She was stunned to learn it existed. Worse yet, someone had sifted through years of her life to unearth it.

There was one more picture.

“It was Matt Bathula,” Jane Doe D said. “They showed me his photo and said, ‘Do you recognize this man and can you tell us his name?’”

Agents assured her that she had done nothing wrong and that it wasn’t her fault. Her husband’s phone had automatically uploaded his photos to Google, she concluded. Yet she blamed herself for weeks afterward until eventually, finally, she just felt disgusted and mad.

“I thought it was going to be some random person in Eastern Europe hacking me,” she said. “Not someone that I knew personally, that I am talking to in clinic and asking about a blood-thinner regimen.

“Were you thinking about my breastfeeding breasts?

“Are you just flashing to that photo of me and my husband?”

Privacy completely destroyed

Hospital attorneys disclosed 49 victims in Maryland by late 2024. One year later, they put the number at more than 100 current and former hospital workers. The FBI’s tally came to 195 victims — not only hospital employees, but their friends and family, too.

Agents tracked down and notified each one of them over the course of four months, said Jimmy Paul, the special agent in charge of the FBI’s Baltimore office. The U.S. attorney’s office in Baltimore declined to explain why it took an additional year for prosecutors to secure an indictment, but a spokesperson said that the office carefully evaluates all evidence before filing charges.

“The investigative process typically begins, but does not always end, with identifying and notifying victims,“ spokesperson Kevin Nash said.

Bathula had allegedly been spying on women for eight years. Investigators found him with one flash drive that alone held 247 sexually explicit photos and 27 videos, according to charging documents. Agents seized dozens of hard drives, USB drives and memory cards.

He’s accused of installing keystroke loggers on computers through the hospital and other tactics to steal women’s usernames and passwords. He allegedly used their credentials to log in remotely and comb through their accounts, downloading intimate materials such as nude photos, diary entries and breastfeeding pictures.

Bathula and his attorney have declined to comment.

His wife filed court papers to return to her maiden name, writing that she was likely getting a divorce.

The women’s lawsuit also accuses Bathula of remotely activating the telehealth webcams in the hospital exam rooms to watch and record his postpartum coworkers while they pumped breast milk. They are suing the hospital system for failing to take basic precautions to lock down the computers. Hospital attorneys estimated the potential civil liability at more than $9.5 million.

Because they are anonymous, the women felt alone with their guilt and shame. They were left to seek out one another by whispers in the halls. Did the FBI call you, too?

“This has all felt a bit like a dystopian matchmaking service,” said Jane Doe E, a doctor.

Jane Doe B, the nurse, dismissed the FBI voicemail as a prank call until agents left a message at her parents’ house. Maybe this was about one of the patients, she told herself.

She agreed to meet at Morning Mugs in Federal Hill. When the FBI agent and counselor sat down and opened the folder, she froze.

The first photo was instantly recognizable — a picture she had texted her husband three years ago. In the photo, she stood before a mirror topless. She couldn’t speak.

“I had a panic attack,” she said.

There were more pictures. Right there in the coffee shop, they showed her four more forgotten nudes that she had sent her husband years ago. The agent asked if she had given Bathula permission to have these, she said. She went outside and threw up on the sidewalk.

“It feels so violating, deeply violating,” she said, “to think that you’re just texting your husband something flirty while on vacation, and the man you just said ‘Good morning’ to at work is also seeing that.”

She went home and cried and called her husband. He came home early, and she wiped everything: photos, messages, passwords, usernames. She destroyed it all, the agent’s words still in her head.

“They kept telling me this was only a small amount of what they found,” she said.

She couldn’t eat or sleep. She struggled to leave the house. Only later would she learn that she was pregnant.

“I was in no condition to be carrying a baby,” Jane Doe B said.

Two weeks later, while on a leave of absence from work, she had a miscarriage.