Cybersecurity firm CEO arrested for installing malware on hospital’s computer

Jeffrey Bowie, the CEO of a cybersecurity firm in Edmond, Oklahoma, has been accused of intentionally installing malicious software on a computer at an Oklahoma City hospital.

The incident took place last year, but only recently led to an arrest.

On August 6th, 2024, a staff member of SSM Health’s St. Anthony Hospital in Oklahoma noticed a man using a hospital computer that was designated for employee use only. The employee addressed the man, and he explained that a family member was undergoing surgery at the hospital and that he needed to use a computer.

St. Anthony Hospital launched an investigation into the matter. Camera footage showed that the man tried to access computers in multiple offices in the hospital. Eventually, he used two computers, one of which was exclusively for employees.

A forensic investigation proved that the man installed malware on the computer, which was for employee use only. The malicious software was programmed to take a screenshot every 20 minutes and send the images to an external IP address.

According to the HIPAA Journal, the unauthorized access was detected in real-time by staff members of the hospital, thus preventing the man from exfiltrating sensitive patient data.

Law enforcement authorities were notified about the man’s plan and identified him as Jeffrey Bowie, the CEO of a local cybersecurity firm. An arrest warrant was issued, and he was arrested by the Oklahoma City Police Department last week.

“On August 6th, 2024, an unauthorized individual was identified accessing a hospital computer in an alleged attempt to install malware. The protection of data and the integrity of our systems are top priorities. Due to precautions in place, the issue was addressed immediately, and no patient information was accessed. We worked closely with law enforcement during the investigation,” St. Anthony Hospital said in a statement to News9.

Bowie has been charged with two counts of violating the Oklahoma Computer Crimes Act. If found guilty of a misdemeanor, he could face a fine of up to $5,000 and 30 days of imprisonment. If the court rules that he committed a felony, the fine could go as high as $100,000, accompanied by a prison sentence between one and ten years.