September 2025 TorchStone Global Monthly Executive Protection Report
TorchStone Global believes that broader situational awareness and intelligence are key to providing quality executive protection—whether the principal is a Fortune 500 CEO, international celebrity, or local city council member. With that in mind, we are launching our monthly executive protection report, cataloging incidents we have captured through our open-source searches that are relevant to the practice of executive protection. We hope the report will serve as a centralized source of threat activity to provide insight into current trends in threats to high-profile individuals.
For more information on customized threat tracking for at-risk individuals, threat assessments, executive protection, or other security services, please contact us.
Quick Links
Summary
The TorchStone Executive Protection Report tracked 36 domestic and 21 international security incidents or updates to prior incidents impacting high-profile individuals during the month of September. Below are some key incidents of note over the past month.
- The September 10, 2025, assassination of conservative political commentator and Turning Point USA cofounder, Charlie Kirk, was the most notable incident for Executive Protection teams this past month. The assassination itself demonstrated again the vulnerability of prominent individuals at public speaking engagements. The assassination also appeared to have triggered additional threats: on the day following the shooting, at least 16 state lawmakers reported receiving threatening messages, some of which referenced the Kirk assassination. TorchStone noted dozens of other, less specific online threats calling for either more assassinations of conservative figures or retribution against his progressive opponents. As of early October, TorchStone is not aware of any copycat or retaliatory attacks in response to the Kirk assassination, but the threat remains present.
- In addition to threats against State lawmakers, there were also several threats to local television stations, including an attack on an ABC affiliate in Sacramento, CA, on September 19. The attack referenced the assassination of Charlie Kirk and came days after ABC late-night talk show host Jimmy Kimmel was suspended for comments he made about Charlie Kirk.
Business Executive
| Location: Orem, UT | Tactic: Attack | Venue: Public Area |
September 10, 2025: Turning Point USA cofounder and conservative influencer Charlie Kirk was shot during a planned public speaking event on the Utah Valley University campus. Kirk was struck in the neck by the shot and was pronounced dead shortly after the area was evacuated. His assassin turned himself in to the authorities almost two days after the murder occurred. Investigations have revealed that the perpetrator communicated his intent to kill, as well as confessing to his partner via text message that he committed the murder.
| Location: Stockholm, Sweden | Tactic: Attack | Venue: Office |
September 23, 2025: Gunmen fired at the gate of Warner Music Sverige’s Stockholm office in the early morning hours, prompting a police investigation into weapons offenses and vandalism. No one was injured during the incident. The label, tied to artists in Sweden’s gangster rap scene, has faced repeated threats—including bombings, extortion, and a 2025 case involving a 16-year-old who bombed an executive’s home. Police linked the attacks to fallout from rapper C. Gambino’s 2024 killing, noting threats accusing the label of funding rival networks.
Celebrity
| Location: Atlanta, GA | Tactic: Harassment | Venue: Public Area |
August 26, 2025: Atlanta police arrested an individual connected to the robbery of a vehicle containing hard drives that stored unreleased music and tour plans from Beyoncé—an incident previously reported in TorchStone’s July EP Report. The suspect remains in custody, and the hard drives remain unrecovered. Police released the call that Beyoncé’s choreographer made to the 911 dispatch, revealing that the thief smashed the rear window of the rental vehicle to reach the hard drives.
| Location: Sinaloa, Mexico | Tactic: Attack | Venue: Public Area |
September 2, 2025: Celebrity Mexican hypnotist, John Milton, suffered gunshot wounds during a carjacking by alleged cartel members. The assailants intercepted Milton’s SUV while he was driving along the Culiacán-Eldorado highway; they then robbed him of the vehicle, firing at him as he fled the scene. Milton escaped with minor injuries, and authorities recovered the SUV several days later.
| Location: Ottawa, Canada | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 4, 2025: British singer Morrissey announced the cancellation of two US shows after receiving a credible death threat prior to his recent performance in Ottawa, Canada. Ottawa Police reported that a 26-year-old man was charged in the case, with further investigation still underway. On September 4, the suspect allegedly posted on BlueSky saying that he intended to shoot the singer with an illegal firearm during his Ottawa show. The singer continued his tour with a performance in Philadelphia on September 23.
| Location: Tijuana, Mexico | Tactic: Verbal/Written Threat | Venue: Public Area |
September 7, 2025: A “narcomanta,” or narco-banner, threatening Musician Antonio “Junior H” Herrera Pérez was discovered on the campus of the Autonomous University of Baja California. The banner, purportedly signed and erected by members of the CNJG cartel, threatened Pérez with physical violence should he perform in Tijuana on September 8; however, the banner was not discovered until September 9, and Pérez was not scheduled to perform in Tijuana until September 11. The banner was taken down, and a criminal investigation is ongoing. Pérez has a history of referencing the exploits of drug cartels in his music, which may have been the cause of CNJG’s threat against him.
| Location: Mohali, India | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 7, 2025: Punjabi musician Mankirt Aulakh received a threatening voicemail from an international phone number (likely registered with WhatsApp or a similar platform) threatening him and his family with violence. A potential suspect was recently arrested, but there are presently no clear connections to an organized criminal effort. The threat was made following Aulakh’s charitable efforts in communities affected by recent floods throughout India.
| Location: Toronto, Canada | Tactic: Attack | Venue: Public Area |
September 8, 2025: An inebriated man assaulted actor James McAvoy while he was visiting film producers at a bar. The assailant was removed from the bar shortly thereafter, and McAvoy successfully managed to de-escalate the resulting uproar after his attack.
| Location: Los Angeles, CA | Tactic: Other Crime | Venue: Public Area |
September 8, 2025: Los Angeles police officers discovered female human remains inside an impounded Tesla registered to singer D4vd (real name David Anthony Burke). The vehicle had been abandoned in the Hollywood Hills and impounded on September 5 after sitting on a public street for more than 72 hours. The incident occurred while D4vd was on tour, and, according to a spokesperson, the artist has fully cooperated with the authorities. LAPD has not yet identified a suspect or officially classified the case as a homicide, though its Robbery Homicide Division is leading the investigation. The L.A. County Medical Examiner identified the victim as 15-year-old Celeste Riva Hernandez, who had reportedly been missing from Lake Elsinore, CA, since April 2024. Additional coverage: TMZ follow-up report.
| Location: Mumbai, India | Tactic: Verbal/Written Threat | Venue: Office |
September 11, 2025: The security protocols for Salman Khan’s reality TV show, Bigg Boss 19, have tightened substantially in response to an influx of death threats made against the Bollywood actor. Specifically, the show no longer hosts a live audience for each episode, entry and exit points for the set have been fortified, and all members of the production crew are subject to routine, mandatory background checks.
| Location: Los Angeles, CA | Tactic: Verbal/Written Threat | Venue: Home |
September 11, 2025: A thief stole a car from Charlize Theron’s Los Angeles home after entering the property through an open gate. They then easily entered Theron’s car, which reportedly still had its key fob inside, and left the property. The LAPD was successfully able to track the vehicle, but the suspect remains at large.
| Location: London, UK | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 14, 2025: British TV personality Thomas Skinner reported that he received death threats following a meeting with Vice President of the United States J.D. Vance on August 13. Skinner did not describe any of these threats in detail, only stating that he is not a “political figure” and didn’t understand the outrage of those threatening him.
| Location: Leawood, KS | Tactic: Stalking | Venue: Home |
September 15, 2025: A man was arrested after jumping a fence at Travis Kelce and Taylor Swift’s Kansas home. The intruder was first spotted by their head of executive protection while Kelce and Swift were in the home. The man, working with actor Justin Baldoni’s legal team, intended to serve a deposition document to Swift regarding her involvement in the lawsuits between Baldoni and Blake Lively.
| Location: Sheffield, England | Tactic: Attack | Venue: Public Area |
September 18, 2025: An assailant punched adult film star Tia “Bonnie Blue” Billinger in the face at a fan meet-and-greet event. Local police detained the assailant shortly thereafter. Billinger’s press team has yet to comment on the incident.
| Location: San Juan, Puerto Rico | Tactic: Stalking | Venue: Other Restricted Area |
September 20, 2025: Rapper Bad Bunny (real name Benito Antonio Martínez Ocasio) was the target of a credible online death threat during his recent residency at the Coliseo de Puerto Rico José Miguel Agrelot in San Juan. A suspect was identified and said to be armed, prompting involvement from the FBI and local authorities, though it remains unclear when the threat was made and whether an arrest occurred. The threat was linked to the final show of his 31-show residency on September 20. The show took place with federal and local security personnel present.
| Location: Los Angeles, CA | Tactic: Harassment | Venue: Home |
September 22, 2025: An unidentified caller initiated a swatting incident at celebrity chef Gordon Ramsay’s Bel Air residence in Los Angeles. The false emergency report prompted law enforcement to deploy a significant response to the property. Ramsay was not at the residence during the incident. Authorities determined the call was a hoax and reported no arrests. This incident demonstrates how swatting continues to target high-profile individuals and underscores the importance of taking proactive measures to mitigate the impact of swatting attempts.
| Location: Cocotitlán, Mexico | Tactic: Attack | Venue: Other Restricted Area |
September 22, 2025: Authorities identified the bodies of Colombian musicians Bayron “B King” Sánchez and Jorge “Regio Clown” Luis Herrera six days after they were declared missing. Sánchez and Herrera were allegedly last seen after a concert in the state of Sonora. The México State Attorney General’s Office carried out the forensic identification of Sánchez and Herrera’s bodies and opened a homicide investigation into the performers’ deaths. The bodies were discovered bound and covered in black plastic bags, an indication they were likely murdered by gunmen from one of Mexico’s criminal cartels.
| Location: San Diego, CA | Tactic: Harassment | Venue: Other Restricted Area |
September 23, 2025: In a recent podcast, Twitch streamers Pokimane, Valkyrae, and QTCinderella expressed apprehension towards attending the upcoming TwitchCon convention due to recent concerns for their physical safety. In particular, QTCinderella recalled almost “dropping all in-person allegations” after a Japanese streamer was attacked and killed in March (as reported in TorchStone’s March 2025 EP Report). Shortly after the podcast aired, Valkyrae and QTCinderella formally announced that they would not attend the event.
| Location: Dublin, Ireland | Tactic: Attack | Venue: Public Area |
September 27, 2025: Unknown assailants assaulted and robbed the backup quarterback for the Pittsburgh Steelers, Skylar Thompson, in Dublin’s Dame Street area. The historic street in the heart of Dublin’s financial district is known for its pubs and nightlife. Thompson suffered minor injuries but was not expected to play in the September 28 game due to previous injuries. The assault occurred just one day before the Pittsburgh Steelers played the Minnesota Vikings in the first regular season NFL game hosted in Dublin, Ireland. As of September 29, there were no details on the suspects behind the assault.
Federal Government
| Location: Dobrá, Czechia | Tactic: Attack | Venue: Public Area |
September 1, 2025: An assailant hit Czech Chamber of Deputies opposition leader Andrej Babiš in the head multiple times with a metal crutch at an election rally. Authorities arrested the assailant immediately after the attack. Babiš was transported to a hospital after the assault and was discharged after a CT scan.
| Location: Hebron, Israel | Tactic: Stalking | Venue: Office |
September 3, 2025: The Israeli Shin Bet, working with the IDF, apprehended Hamas operatives near Hebron who were plotting to assassinate Minister of National Security Itamar Ben Gvir. The Hamas operatives were in possession of several drones, which were reportedly to be used in the planned attack.
| Location: Leesburg, VA | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 15, 2025: U.S. Representative Suhas Subramanyam reported that an individual emailed him a violent threat targeting his district office. In the email, the suspect claimed that they would bring a firearm to Subramanyam’s office. U.S. Capitol Police identified and apprehended the sender, and a temporary protective order was issued against them.
| Location: Washington, D.C. | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 11, 2025: U.S. Capitol Police were informed of a bomb threat directed at the Democratic National Convention HQ. The building was cleared, and the threat was confirmed as a hoax. An investigation into the sender of the bomb threat is ongoing.
| Location: Pittsburgh, PA | Tactic: Attack | Venue: Other Restricted Area |
September 16, 2025: A man drove his vehicle through the entrance gate of the FBI’s Pittsburgh field office. The FBI classified the vehicular assault as a “targeted attack” against the agency and its constituents. An eyewitness reported that the suspect threw an American flag over the gate after the crash and left the scene on foot. The ensuing investigation revealed that the car had the phrase “Sic semper tyrannis” written on one of its windows. The suspect—a military veteran with a history of mental health issues—had visited the field office a few weeks before issuing an irrational complaint. The suspect remains in custody.
| Location: Washington, D.C. | Tactic: Verbal/Written Threat | Venue: Home |
September 19, 2025: A bomb threat was issued to HHS Secretary Robert F. Kennedy Jr.’s home in Georgetown. Police searched the property and found no explosive devices. An investigation is ongoing.
| Location: Washington, D.C. | Tactic: Harassment | Venue: Home |
September 22, 2025: A doxxing attack revealed acting U.S. Immigration and Customs Enforcement (ICE) director Todd Lyons’ home address to the public. The information was posted on a website documenting ICE activities in Massachusetts and included images of Lyons’ home and personal vehicle. This incident is significant in that it involves the dissemination of a high-profile individual’s personally identifiable information—the definition of doxxing.
| Location: Montevideo, Uruguay | Tactic: Attack | Venue: Home |
September 28, 2025: Two armed individuals broke into the home of Uruguay’s acting Attorney General, Mónica Ferrero. The individuals opened fire inside the residence, but no one was injured. The two suspects were arrested and may have connections to a local drug gang. Investigators also discovered a hole in Ferrero’s backyard where explosives may have been planned to be planted. The attack is believed to be retaliation for a recent mass drug seizure linked to Uruguayan trafficker Sebastián Marset.
| Location: Cotacachi, Ecuador | Tactic: Attack | Venue: Public Area |
September 28, 2025: Armed protestors attacked a humanitarian convoy led by Ecuador President Daniel Noboa and containing various UN and EU diplomats. Noboa remained unharmed, but 17 Ecuadorian armed forces personnel were taken hostage, and a further 12 were reportedly injured. One of the protestors was shot three times and killed by the armed forces. The attack occurred amid an indefinite national strike protesting Noboa’s intent to cut fuel subsidies.
State Government
| Location: Rogers, AR | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 31, 2024: The Benton County Prosecutor’s Office sentenced a man who threatened to harm and murder Arkansas Governor Sarah Huckabee Sanders to six years in prison. The suspect made his threats via calls to the Arkansas State Police dispatch in January 2024. His threats were disturbingly graphic in nature and claimed that he would rape, maim, and murder Huckabee Sanders and the rest of her family.
| Location: Lovettsville, VA | Tactic: Verbal/Written Threat | Venue: Communication Channels |
August 26, 2025: Virginia Delegate Geary Higgins received a death threat targeting him and his family via text. The suspect sent the text in response to Higgins’ public denouncement of an individual who held a racist sign targeting Virginia Lieutenant Governor and gubernatorial candidate Winsome Earle-Sears at a rally earlier in the month. Authorities identified the sender and arrested him.
| Location: Hooksett, NH | Tactic: Verbal/Written Threat | Venue: Communication Channels |
August 28, 2025: A man threatened to kill New Hampshire Governor Kelly Ayotte in a Snapchat conversation with a woman. The woman reported the interaction to the police, noting that the suspect made antisemitic remarks and mentioned owning guns and making pipe bombs. The suspect also sent images of metal tubes he intended to turn into pipe bombs and allegedly disassembled fireworks to construct them.
| Location: Tripura, India | Tactic: Harassment | Venue: Other Restricted Area |
September 1, 2025: Several individuals harassed Tripura Legislative Assembly member Philip Kumar Reang outside the hostel he was staying at, an incident he cited as a “security lapse”. Reang stated that his harassers “threatened [him] with dire consequences,” prompting police to investigate. The suspects were identified and are now subject to legal complaints. Investigators also found that the hostel failed to maintain vehicle entry and exit records.
| Location: Tula, Hidalgo, Mexico | Tactic: Attack | Venue: Public Area |
September 3, 2025: Gunmen shot Hidalgo State Criminal Judge Víctor Hugo Matadamas Barranco while he was traveling through the Iturbe neighborhood of Tula. The gunmen, riding motorcycles, fired three times, causing Barranco to crash his car. He was rushed to a hospital in stable condition, and the investigation into the shooters is ongoing.
| Location: Annapolis, MD | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 11, 2025: Maryland Senate President Bill Ferguson received a bomb threat targeting his residence. Baltimore and Maryland State Police cleared the site of any potential threats.
| Location: Annapolis, MD | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 11, 2025:Maryland House Speaker Adrienne Jones also received a bomb threat targeting her residence. No device was found, and no one was harmed.
| Location: Providence, RI | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 11, 2025: Rhode Island State Senate President Valarie Lawson’s home was targeted in a bomb threat following Charlie Kirk’s assassination. State police cleared her home of any threats.
| Location: Providence, RI | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 11, 2025: Rhode Island Senate Majority Leader Frank Ciccone was also targeted in a bomb threat. Ciccone was attending a conference in California at the time and stated he was “not concerned,” expressing confidence in his home security systems. Rhode Island State Police later determined the threat was non-credible.
| Location: Lansing, MI | Tactic: Verbal/Written Threat | Venue: Home |
September 11, 2025: Michigan Lieutenant Governor Garlin Gilchrist II’s home and family were targeted by a bomb threat. Law enforcement quickly intervened and cleared the threat. Gilchrist later condemned the incident as part of the broader rise in political violence.
| Location: Southfield, MI | Tactic: Verbal/Written Threat | Venue: Home |
September 11, 2025: Michigan Senate President Pro Tempore Jeremy Moss’ home was targeted by a bomb threat on the same day as Lt. Gov. Gilchrist’s. Moss described the threat as “detailed and specific.” Law enforcement secured his property, and no device was located.
Local Government
| Location: Daraa, Syria | Tactic: Attack | Venue: Public Area |
September 1, 2025: Multiple assailants shot Muneef al-Zaim, a public relations official on the Daraa Provincial Council. Al-Zaim was transferred to a hospital in Damascus in critical condition. The assailants remain unidentified.
| Location: Jamestown, NM | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 10, 2025: A New Mexico teenager posted violent threats against racial and ethnic minorities on X following the assassination of Charlie Kirk. The suspect also threatened to kill an unspecified Ohio city council member. The FBI traced his location via cellphone and found images of him firing multiple guns earlier in the year. The suspect, who identified as a Neo-Nazi accelerationist, remains in custody facing federal charges for transmitting communications containing a threat to injure another person.
| Location: Palm Beach, FL | Tactic: Verbal/Written Threat | Venue: Communication Channels |
September 22, 2025: Palm Beach County School Board Member Edwin Ferguson reported receiving a racially charged death threat via voicemail. Ferguson received the message shortly after publicly criticizing Charlie Kirk following his murder. Local law enforcement launched an investigation, which remains ongoing.
Community Leader
| Location: Manchester, England | Tactic: Harassment | Venue: Office |
September 8, 2025: Youth Demand activists occupied the lobby of the BBC’s Manchester office to protest the network’s failure to report on Israeli war efforts in Gaza. The BBC has yet to comment on the incident.
| Location: Salt Lake City, UT | Tactic: Attack | Venue: Public Area |
September 12, 2025: Two men placed an incendiary device under a FOX 13 News vehicle. The device was activated but failed to fully ignite. After the FBI assumed jurisdiction over the investigation, they identified the two suspects in the nearby city of Magna. When captured, the men referred to the device as a “hoax [weapon] of mass destruction.” Both men face terrorism charges.
| Location: Dublin, Ireland | Tactic: Harassment | Venue: Public Area |
September 16, 2025: David Quinn, CEO of the Iona Institute (conservative Christian advocacy group), received a package that was filled with an unknown white powder at Merrion Square. A note in the package included an expletive-filled message directed at Quinn and claimed that the powder was Anthrax spores. Quinn alerted local authorities, who cordoned off the square for further investigation. The powder was determined to be harmless.
| Location: Sacramento, CA | Tactic: Attack | Venue: Office |
September 19, 2025: Police arrested a man for firing three shots at the local KXTV station. Although the suspect was released on bail, the FBI arrested him shortly thereafter, and he currently faces federal charges. Further investigation into the suspect indicated that he was critical of the Trump administration in his social media presence—notably after ABC’s firing of Jimmy Kimmel. Investigators found notes in the man’s house and car related to the event, reading “For hiding Epstein & ignoring red flags. Do not support Patel, Bongino, & AG Pam Bondi. They’re next. – C.K. (likely referencing Charlie Kirk) from above,” and “Friday — Do The Next Scary Thing,” respectively.