Don’t Connect Dots for Threat Actors
By TorchStone VP, Scott Stewart
Social media provides unprecedented opportunities for connection, self-promotion, and brand building. However, it also creates vulnerabilities that can be exploited by those with malicious intent. Sharing too much information—especially details that reveal predictable patterns of movement—can be deadly. When bad actors can “connect the dots” of a person’s whereabouts, they gain the ability to plan and execute an ambush.
Airi Sato – Social Media Influencer
On March 12, 2025, Japanese social media influencer Airi Sato was attacked in real life as she was broadcasting a livestream video of herself walking down the street in Tokyo’s Shinjuku ward at 9:55 AM. Sato, who regularly posted livestream videos of her daily life on the Japanese platform WhoWatch, was stabbed some thirty times in the head and neck by her assailant and could be heard screaming by those watching the stream—until the feed went black. Ms. Sato was transported to a hospital where she was pronounced dead.
Her alleged killer, a 42-year-old unemployed man from Oyama, in Japan’s Tochigi Prefecture, was arrested by Tokyo police shortly after the attack and was found to be carrying a large survival knife, he is alleged to have used in the attack.
Investigators learned the alleged attacker was an avid fan of Ms. Sato who began watching her streams in 2021 and who had lent her some ¥2.5 million (approximately $17,000) in 2022 and 2023, causing him to go deeply into debt. The man reportedly sued Ms. Sato in an attempt to recover the money in August 2023 and won the lawsuit, with the court ordering Ms. Sato to repay the money. Apparently, she only repaid ¥30,000 of the debt before breaking off contact with the suspect.
Frustrated, by his inability to recoup his monetary losses, the suspect contacted the police in Tochigi Prefecture in January 2024 to report that Ms. Sato had gone dark and was avoiding him so that she did not have to repay the debt.
It would appear the subject continued to feed his grievance since that time. Police report that approximately two or three months ago he ordered the survival knife online. He then carried the knife with him to Tokyo intending to attack Ms. Sato. The alleged attacker was able to determine her exact location due to distinct buildings he could see in the background of her livestream and vectored in to attack her. Ms. Sato had unknowingly connected the dots of time and location—and facilitated the deadly attack that took her life.
Mayu Tomita – Pop Star
This is not the first incident of a high-profile Japanese woman being stalked and attacked by a resentful former fan. In May of 2016, Japanese pop star Mayu Tomita was critically injured when an attacker stabbed her 61 times in the head, neck, and torso as she arrived at a venue prior to a concert.
Ms. Tomita’s assailant was an obsessed fan who had messaged her on Twitter and via her blog. He admitted during his trial that he had wanted to marry the singer, but his adoration quickly transformed into rage when gifts he sent to her were returned unopened. The rejected suitor sent Ms. Tomita some 400 threatening tweets, which led the singer to contact the police, but the police dismissed the threats as harmless, and Ms. Tomita was not provided with any protection. On the day of the attack, she rode the subway from her apartment to a concert venue where she was scheduled to perform and was attacked while walking alone from the subway to the venue.
Your Everyday Can Create Opportunity
The murder of Ms. Tomita near a venue where she was scheduled to perform was similar in nature to the attack against United HealthCare CEO Brian Thompson, who was murdered as he was walking to a hotel where he was scheduled to speak at an investor’s conference.
Predictable or identifiable places and times are dangerous because they provide a potential attacker the opportunity to plan and execute an ambush attack. Because of this people who are potential targets should take extra care as they approach such locations, either by elevating their level of situational awareness, or by elevating their level of security, based on the level of threat they are facing.
Aggrieved and unstable people who have become fixated on a specific target pose a significant threat to prominent personalities. Additionally, as illustrated by countless domestic violence cases, they also pose a significant threat to ordinary people they hold a grievance against and become fixated on.
Unstable and aggrieved individuals pose a significant challenge for security teams and law enforcement because they tend to operate alone and frequently have little or no concern about being caught, or for the consequences of their actions. As illustrated by the cases mentioned above, unstable or aggrieved individuals may or may not attempt to communicate with their intended target before launching an attack.
Due to the serious threat posed by such individuals, any unstable person who displays an unhealthy fixation on a prominent person, expresses a grievance with them, or attempts to approach or communicate with them, should be carefully evaluated to determine if they pose a threat, no matter how irrational their demands or grievances may appear. Especially so for any individual who shows a persistent focus of interest in the prominent person. Early identification of potential threats and efforts to interdict them are critical components of a proactive protective intelligence program.
Athlete Residences – NFL and NBA
Of course, not all threat actors are looking to harm the person they are seeking to target. Sometimes they just want to steal their belongings. There are many cases in which thieves have used the social media posts of their victims to plan robberies. Perhaps the most high-profile example of this recently was the Chilean organized crime groups that were targeting the homes of NFL and NBA athletes.
According to an FBI bulletin provided to professional sports leagues that was obtained and reported on by ABC News, the “organized theft groups from South America conduct physical and technical surveillance in preparation for these burglaries, using publicly available information and social media to identify a pattern of life for a prospective victim. They often know in advance where valuables are kept in a home.” (Emphasis added.) In these cases, the athletes’ game schedules connected the dots of time and location and allowed the criminals to use them in a different manner: to predict when they would not be home. However, the social media posts made by the targeted athletes assisted the criminals in conducting their attack cycle for the thefts by allowing them to see what valuables were kept in the home, as well as where they were kept and what security features were present in the residence.
The FBI bulletin continued: “These preparation tactics enable theft groups to conduct burglaries in a short amount of time. Organized theft groups bypass alarm systems, use Wi-Fi jammers to block Wi-Fi connections and disable devices, cover security cameras, and obfuscate their identities.”
Balancing Online Presence and Personal Security
In the current digital age, it is important for athletes, executives, and entertainers to promote their individual brands, their companies, and their projects. In fact, influencers like Ms. Sato can’t make a living without a robust social media presence.
However, people must be intentional about what they post online, with an eye toward safeguarding their privacy and physical safety while they are promoting themselves and their brand. With a little thought and effort, a person can have a presence on social media while denying bad actors the critical pieces of information they need to connect the dots and conduct an attack.