April 2026 TorchStone Global Monthly Executive Protection Report
TorchStone Global believes that broader situational awareness and intelligence are key to providing quality executive protection—whether the principal is a Fortune 500 CEO, international celebrity, or local city council member. Our monthly executive protection report catalogues incidents we have captured through our open-source searches that are relevant to the practice of executive protection. We hope the report will serve as a centralized source of threat activity to provide insight into current trends in threats to high-profile individuals.
For more information on customized threat tracking for at-risk individuals, threat assessments, executive protection, or other security services, please contact us.
Quick Links
Summary
The TorchStone Executive Protection Report tracked 26 domestic and 12 international security incidents or updates to prior incidents impacting high-profile individuals during the month of April 2026. Below are some key incidents of note over the past month.
- Several events over the month of April highlighted an escalation of anti-AI threats directly targeting prominent figures in the artificial intelligence industry. Two attacks targeted OpenAI CEO Sam Altman. His San Francisco home was first struck by a Molotov cocktail, an incident linked to an assailant carrying an explicitly anti-AI manifesto, and then struck by gunfire just days later in a suspected drive-by shooting. In a related, but less widely reported incident, an individual fired at the front door of an Indianapolis City-County Councilor’s home and left a message protesting data centers. The incident highlights opposition to data centers that provide the computing power needed to support AI platforms and services. These attacks come within the context of anti-AI sentiment due to fears over job displacement, wealth concentration, environmental degradation, and perceived existential risks associated with advanced AI systems. The convergence of ideological grievance, online radicalization, and symbolic targeting of AI figures indicates a developing threat landscape in which high-visibility tech leaders are increasingly viewed as legitimate targets by fringe anti-technology movements.
- Within the same reporting window, TorchStone identified three incidents of security teams preventing potentially lethal attacks by keeping threats out of restricted spaces where national leaders, corporate executives, and a German mayor were working. In the most widely reported incident, a man attempted to assassinate President Donald Trump and other administration officials during the 2026 White House Correspondents’ Dinner at the Washington Hilton Hotel on April 25. But there were two other, less widely reported incidents that highlight the importance of basic physical security measures in stopping potential attacks. On April 16, a 51-year-old man carrying a loaded AR-style pistol in his backpack attempted to enter Aetna’s headquarters in Connecticut during a meeting involving senior executives, prompting a rapid security response that intercepted him, avoiding any injuries. In another incident, a security guard at Munich city hall in Germany alerted law enforcement to a man wielding a knife traversing the building’s halls near midnight, preventing him from engaging the mayor, who was in his office at the time.
- Conversely, an incident on April 28 highlights the consequences of gaps in venue security. An 89-year-old man carried out armed attacks against two Greek government offices in central Athens, injuring five employees. The suspect gave detailed descriptions of how he had planned his attack over multiple months and conducted surveillance on the buildings to determine the most vulnerable entrances and guards to target. He was not challenged by police until a member of the public recognized and reported him over 100 miles west of Athens. In this case, the outcome could have been much worse had the shooter intended to kill people.
Together, these cases reinforce the importance of protecting office spaces and event venues associated with high-profile leaders and essential services. We believe that threats against leaders in the AI field will continue and will likely converge with anti-wealth grievances. These threats can manifest in protest action, sabotage, and direct threats against key leaders and their families.
Please find the full list of incidents categorized below.
Business Executive
| Location: San Francisco, CA | Tactic: Attack | Venue: Home |
April 10, 2026: In the early morning, a man threw a Molotov cocktail at OpenAI CEO Sam Altman’s home; it bounced off without causing injuries. Police arrested the suspect after he also threatened to burn down OpenAI’s headquarters.
| Location: San Francisco, CA | Tactic: Attack | Venue: Home |
April 12, 2026: At about 2:56 a.m., officers responded to reports of gunfire, detained two suspects, and recovered three firearms from a residence near Sam Altman’s residence. Despite the proximity of this incident to the April 10 attack that preceded it, the incidents have been deemed unrelated. However, it is possible that heavy media coverage of the April 10 incident motivated the April 12 incident.
| Location: Hartford, CT | Tactic: Stalking | Venue: Office |
April 16, 2026: A 51-year-old man carrying a loaded AR-style pistol in his backpack attempted to enter Aetna’s headquarters during a meeting involving senior executives, prompting a rapid security response. He reportedly tried to access the building multiple times, even succeeding at one point, before security quickly detained him. Authorities later arrested and charged him with multiple firearms and trespassing offenses; no injuries were reported. An investigation is ongoing.
| Location: Los Angeles, CA | Tactic: Attack | Venue: Home |
April 23, 2026: Robbers forced entry into the Hollywood Hills home of Margaux Mirkin, a member of the family that founded Budget Rent a Car, assaulting her in the process. The suspects strangled and struck Ms. Mirkin and stole cash and jewelry before leaving the scene. Emergency responders transported her to a hospital for treatment and later released her. Law enforcement continues to investigate and search for suspects.
| Location: Volgograd, Russia | Tactic: Attack | Venue: Public Area |
April 24, 2026: Sergei Loyter, a Yandex executive, died under unclear circumstances. The entrepreneur reportedly drowned while fishing on the Volga River near Volgograd with three other fishermen. Authorities identified Loyter among the bodies of the missing fishermen. Loyter’s body reportedly shows signs of head trauma.
| Location: Volgograd, Russia | Tactic: Attack | Venue: Public Area |
April 24, 2026: Tech entrepreneur Sergei Nazarov, who was Loyter’s father-in-law, also died of drowning. Loyter and Nazarov’s deaths add to a series of suspicious Russian business leader deaths since the Ukraine war began.
Celebrity
| Location: Dallas, TX | Tactic: Attack | Venue: Restricted Area |
January 10, 2026: Federal authorities charged nine men—including rappers Lontrell Williams Jr. (alias Pooh Shiesty) and Rodney Wright Jr. (alias Big30)—with kidnapping and robbing three music industry professionals at gunpoint in a Dallas studio on January 10, 2026. Victims were forced to sign a contract release, robbed, and attacked. Williams Jr., on home detention, allegedly violated his conditions. Investigators linked the group through video, phone records, fingerprints, and social media. Each faces up to life in prison. Authorities unsealed the complaint on April 2, 2026.
| Location: Santa Rosa Beach, FL | Tactic: Attack | Venue: Home |
March 22, 2026: Musician Brian Littrell alleges a trespasser struck him during a confrontation on his private Florida beach property. The Backstreet Boys singer confronted a man who had set up a beach chair on his property and refused to leave; Littrell claims the man swiped at him, knocked his phone from his hand, and hit him in the face, prompting him to call 911. Video footage shows the man pushing the phone away while telling Littrell to get out of his face. Prosecutors later declined to file charges, citing insufficient evidence of criminal intent.
| Location: Santa Monica, CA | Tactic: Attack | Venue: Public Area |
April 1, 2026: A known female stalking suspect targeted Lindsey Buckingham, former Fleetwood Mac guitarist and vocalist, as he arrived for an appointment in Santa Monica. The suspect threw an unknown substance at Buckingham as he entered the building and immediately fled. Law enforcement has identified the individual, who has prior connections to Buckingham, but made no arrests as of early April 1. Authorities believe the suspect obtained advance knowledge of Buckingham’s appointment and location. Buckingham was unharmed.
| Location: Los Angeles, CA | Tactic: Stalking | Venue: Home |
April 1, 2026: Local police arrested a suspect who wandered into the backyard of Nicki Minaj’s Hidden Hills residence. Neighbors observed the individual and contacted law enforcement. Minaj was not present at the time of the incident.
| Location: Los Angeles, CA | Tactic: Harassment | Venue: Restricted Area |
April 5, 2026: Influencer Zavala hosted a birthday party at Los Globos Nightclub in Silver Lake that was disrupted around 1:30 a.m. when an individual called in a false bomb threat, prompting a large LAPD response and the evacuation of hundreds from the club and surrounding streets. Officers and air units responded to the scene but found no explosives. A fight occurred during the incident, and one person received treatment for a minor eye injury. The incident marks the second recent swatting involving Zavala.
| Location: Hollywood, FL | Tactic: Attack | Venue: Public Area |
April 6, 2026: A gunman shot rapper Kiari Kendrell Cephus, known as Offset, in the valet area outside the Seminole Hard Rock Hotel & Casino. His representative said he is in stable condition and is expected to recover. Seminole Police detained two people at the scene, quickly contained the situation, and said there is no ongoing threat to the public. The investigation remains active.
| Location: New York, NY | Tactic: Attack | Venue: Public Area |
April 14, 2026: An unidentified individual assaulted influencer Nicolas “Sneako” De Balinthazy in the middle of his livestream on a sidewalk in New York. The assailant struck De Balinthazy while he was distracted, knocking him to the ground. Although a brief physical struggle ensued, De Balinthazy later stated he was not seriously injured and that the situation had been “handled.”
| Location: Mexico City, Mexico | Tactic: Attack | Venue: Home |
April 14, 2026: Model Carolina Flores Gómez was shot and killed by her mother-in-law at her apartment. Video footage of the incident revealed that the two engaged in a relatively normal conversation prior to the shooting, suggesting that the incident was premeditated. Despite Gómez’s husband and infant son being home at the time of the shooting, police were not notified until the next day. The husband claimed he was unable to call authorities out of concern for his child’s safety; however, he may be investigated for potential complicity in the murder.
| Location: Erie, PA | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 15, 2026: Actor Walker Scobell skipped his high school prom after people sent death threats to girls they thought might go with him, raising safety concerns. He spoke out against the harassment, saying the girls did nothing wrong and calling for it to stop.
| Location: Los Angeles, CA | Tactic: Attack | Venue: Public Area |
April 15, 2026: An unidentified woman assaulted rapper Ice Spice (Isis Naija Gaston) during an early-morning incident at a Hollywood area McDonald’s. The unidentified woman approached Ms. Gaston’s table and attempted to initiate contact. After being dismissed, the individual became agitated and slapped the artist, triggering a physical altercation that continued inside and outside the restaurant. The assailant’s motivation appears tied to perceived disrespect after a failed attempt to engage, escalating from fan interaction to violence. The attack was enabled by close physical access in a public, low-security environment with no immediate protective assets.
| Location: Los Angeles, CA | Tactic: Attack | Venue: Home |
April 17, 2026: Actor Dylan Sprouse tackled an intruder at his Hollywood Hills home in the middle of the night. The suspect, who reportedly had outstanding warrants, appears to have been operated out of opportunistic criminal intent and did not specifically target Sprouse’s residence. The individual was able to breach the property’s perimeter, suggesting gaps in physical security or surveillance. This is at least the second attempted intrusion at Sprouse’s home. The incident highlights how failure to respond to threats, reduced overnight vigilance, and insufficient perimeter controls can enable unauthorized access and escalate into direct confrontations.
| Location: Los Angeles, CA | Tactic: Stalking | Venue: Home |
April 17, 2026: Los Angeles police responded to the home of model and social media influencer Lindsey Pelas after she reported seeing a man on her property. Officers arrived quickly, but the man left before they could make contact. TorchStone covered two similar trespassing events at Pelas’ residence in its February 2026 report. Contrary to their reported findings in February, authorities claimed the April trespasser may be the same person involved in prior trespassing incidents. As with the previous incidents, police issued a violation of a restraining order report.
| Location: London, UK | Tactic: Attack | Venue: Public Area |
April 20, 2026: A car struck and critically injured social media influencer Klaudia Zakrzewska as she stood outside a nightclub in Soho. The driver allegedly engaged in an altercation with Zakrzewska prior to the incident. Zakrzewska succumbed to her injuries on 25 April 2026, and the driver faces an attempted murder charge.
| Location: Central Otago, New Zealand | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 21, 2026: In a post on his Instagram account, actor Sir Sam Neill revealed that he has received several threats of physical violence issued in response to his public stance against the development of a gold mine in the Central Otago region of New Zealand. Neill did not specify details surrounding the threats.
| Location: London, UK | Tactic: Stalking | Venue: Restricted Area |
April 28, 2026: A man breached the perimeter fence of the Israeli Embassy to the UK in the evening hours. The intruder carried two knives and intended to carry out a terrorist attack; however, onsite security quickly subdued and detained him before he could advance. Further investigation revealed that the perpetrator repeatedly searched for information regarding the embassy on his phone and left a note pledging martyrdom on the day of his intrusion, suggesting that the incident was significantly premeditated and that he intended to conduct a violent attack.
Federal Government
| Location: Istanbul, Turkey | Tactic: Attack | Venue: Office |
April 7, 2026: Three gunmen opened fire near the Israeli consulate in Istanbul, injuring two police officers. The police killed all three gunmen in the resulting firefight. Turkish authorities and Israeli officials described the incident as a terrorist attack. No consulate staff were harmed.
| Location: Tampa, FL | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 8, 2026: After a joint investigation between Tampa police and the FBI, authorities arrested a man after he published two videos threatening FBI Director Kash Patel and Secretary of War Pete Hegseth. The platform on which the man published the videos remains unclear.
| Location: Phoenix, AZ | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 21, 2026: U.S. Representative Yassamin Ansari reported that she and her family have received numerous threats of violence since the beginning of the war in Iran on February 28, 2026. In her post, Ansari revealed that the threats included AI-generated images of her and her family.
| Location: Washington, DC | Tactic: Attack | Venue: Restricted Area |
April 25, 2026: A man attempted to assassinate President Donald Trump and other officials in his administration during the 2026 White House Correspondents’ Dinner at the Washington Hilton Hotel. The assailant, originally from California, conducted detailed surveillance of the hotel and its attendees prior to his attack and booked a room for a timeframe intersecting with the April 25 event. After determining a window for the attack via a livestream of the event, the assailant ran past the hotel’s magnetometers and attempted to evade the United States Secret Service detail manning the checkpoint. Following a brief exchange of fire, Secret Service officers subdued and apprehended the assailant.
| Location: Athens, Greece | Tactic: Attack | Venue: Office |
April 28, 2026: An 89-year-old man evaded security and opened fire on two separate national government services offices—a social security office and an appeals court. The attack injured five employees in total. Police caught the shooter later that day after he fled to a city 120 miles west of Athens. He told police he was on his way to Strasbourg, France to carry out attacks on European Union offices there, as well. The shooter had conducted surveillance on the offices before the attack, noting which entrances were less secured and which guards were less attentive.
State Government
| Location: Ouachita, LA | Tactic: Verbal/Written Threat | Venue: Communication Channels |
June 21, 2025: A Delaware man sent several death threats to Louisiana state Representative Michael Echols via direct messages to his X account. The threats were reportedly made in connection with legislation that Echols authored regarding hospital operators. Police arrested the perpetrator in early April 2026.
| Location: Arlington, TX | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 1, 2026: Police arrested a man for issuing a death threat to Louisiana state Senator Jay Morris and his family. The threat was made to Morris’ office phone and was reportedly connected to legislation that Morris authored that would restructure the state’s judicial system.
Local Government
| Location: Dearborn, MI | Tactic: Verbal/Written Threat | Venue: Communication Channels |
February 17, 2026: The Wayne County Prosecutor’s Office charged a man with one count of malicious use of telecommunications services after he threatened to assassinate Dearborn Mayor Abdullah Hammoud; it is unclear whether the threats were issued via SMS or voicemail. The perpetrator was released on March 28, 2026 under a GPS surveillance order.
| Location: Colorado Springs, CO | Tactic: Harassment | Venue: Communication Channels |
April 1, 2026: Prosecutors sentenced a man to 46 months in federal prison due to his involvement in a “hate crime hoax” targeting Colorado Springs Mayor Yemi Mobolade—then a mayoral candidate running for the office—in April 2023. The suspect and his accomplices placed a burning cross next to one of Mobolade’s campaign signs and defaced it with a racial slur. Afterward, the suspects publicized the threat on social media and emailed Mobolade claiming that one of his political rivals ordered it.
| Location: Indianapolis, IN | Tactic: Attack | Venue: Home |
April 6, 2026: An individual fired 13 rounds at the front door of Indianapolis City-County Councilor Ron Gibson’s Near Eastside home in the early morning and left a handwritten note reading “No Data Centers.” No one was injured. Gibson was likely targeted due to his involvement in debates over a proposed data center in his constituent district. The Indianapolis Metropolitan Police Department, with assistance from the FBI, continues to investigate the incident.
| Location: Rockford, IL | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 10, 2026: Police arrested a man who sent a death threat via email to Rockford Mayor Tom McNamara. While being interviewed by authorities, the man claimed he intended to shoot McNamara in the head.
| Location: Washington, DC | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 17, 2026: In a post on his X account, DC mayoral candidate Kenyan McDuffie revealed that an individual sent a threatening text to his daughter following a public dispute regarding ride-share app regulations. Authorities arrested the perpetrator shortly thereafter.
| Location: Aybastı, Turkey | Tactic: Attack | Venue: Office |
April 21, 2026: An elderly man entered Aybastı’s municipal office and struck a secretary working under the municipality’s mayor on the back of his head with a cleaver. Despite sustaining a wound, the secretary restrained the assailant, and authorities detained him shortly thereafter.
| Location: Munich, Germany | Tactic: Attack | Venue: Public Area |
April 25, 2026: A security guard at the Munich city hall alerted law enforcement to a man wielding a knife traversing the building’s halls near midnight. Further investigation revealed that the man likely maintained a politically motivated negative fixation on the city’s recently elected mayor, Dominik Krause. Krause was still in his office at the time of the incident but did not encounter the perpetrator.
Community Leader
| Location: Bissau, Guinea-Bissau | Tactic: Attack | Venue: Public Area |
March 31, 2026: Authorities and civil society groups in Guinea-Bissau are investigating the killing of political activist Vigário Luís Balanta, whose body was found abandoned about 30 kilometers outside the country’s capital. Reports indicate attackers beat and tortured Balanta—an outspoken critic of the ruling authorities and president of the Pó di Terra Revolutionary Movement—before killing him, prompting widespread condemnation and calls for an independent investigation.
| Location: New Lenox, IL | Tactic: Other Crime | Venue: Home |
April 15, 2026: Authorities responded to a bomb threat at the Illinois home of Louis Prevost, the brother of Pope Leo XIV, evacuating residents and deploying officers and K-9 units to search the property. Investigators found no explosives and cleared the scene of threats. The incident may have been a swatting attempt following President Trump’s criticism of Pope Leo XIV’s comments against the U.S./Israel’s military actions against Iran.
| Location: Berlin, Germany | Tactic: Attack | Venue: Public Area |
April 22, 2026: An assailant tossed tomato juice onto the exiled Crown Prince Reza Pahlavi of Iran as he departed a press briefing. Authorities promptly arrested the assailant, and Pahlavi was unharmed by the attack.