April 2025 TorchStone Global Monthly Executive Protection Report
TorchStone Global believes that broader situational awareness and intelligence are key to providing quality executive protection—whether the principal is a Fortune 500 CEO, international celebrity, or local city council member. With that in mind, we are launching our monthly executive protection report, cataloging incidents we have captured through our open-source searches that are relevant to the practice of executive protection. We hope the report will serve as a centralized source of threat activity to provide insight into current trends in threats to high-profile individuals.
For more information on customized threat tracking for at-risk individuals, threat assessments, executive protection, or other security services, please contact us.
Quick Links
Summary
The TorchStone Executive Protection Report tracked 23 domestic and 15 international security incidents or updates to prior incidents impacting high-profile individuals during the month of April. Below are some key incidents of note over the past month.
- The homes of business executives and government leaders alike continued to be a popular venue for harassment and attacks targeting high-profile individuals. Demonstrations targeted the Manhattan homes of two wealthy investors to mark Earth Day on April 22, 2025. Police arrested several activists who blocked the entrance to a building where investor Bill Ackman has a residence. Police cordoned off the street in front of the home of Tesla board member James Murdoch before environmentalist activists staged a pre-announced protest calling for the firing of Tesla CEO Elon Musk. That protest coincided with the release of Tesla’s quarterly earnings report. Activist groups have often encouraged targeting the homes of investors and executives to intimidate them and their families and coerce them into changing their behavior.
- On April 12, 2025, a person apparently motivated by ideological extremism attacked the Pennsylvania Governor’s residence with an incendiary device on the eve of Passover, in what appears to be an antisemitic attack. The fire caused significant damage to the historic mansion, but no injuries were reported. Governor Josh Shapiro and his family were asleep inside at the time of the attack and had to evacuate. Authorities arrested the attacker, who allegedly scaled the security fence, broke windows, and ignited Molotov cocktails in the residence’s south wing. The suspect is facing multiple charges, including attempted murder and terrorism, and reportedly expressed intent to harm the governor, citing political and religious grievances.
- A mentally unstable individual harboring general grievances against the healthcare industry attempted to carry out a copycat attack against UnitedHealthcare – this time against their headquarters building in Minnesota. Police responded to and apprehended the armed individual before he caused any harm. The suspect’s mother told the media that she believed her son acted out to get attention and to make a statement against the healthcare industry, in general. High levels of anti-CEO extremist rhetoric online following last year’s assassination of UnitedHealthcare’s CEO have contributed to concerns about further copycat attacks against CEOs and their families.
Business Executive
| Location: Minnetonka, MN | Tactic: Stalking | Venue: Office |
April 14, 2025: A man intruded on the UnitedHealthcare Minnetonka campus, threatening violence if his demands were not met. Police found a gun in the suspect’s car, and the suspect’s mother suggested he wanted to make a statement. It remains unclear how the suspect entered the building, and police note that he did not have any prior grievances towards United Healthcare. The incident follows the assassination of United Healthcare’s CEO in December 2024. The assassination sparked fears of copycat attacks, and this latest incident at the UnitedHealthcare campus in Minnesota highlights the validity of those concerns.
| Location: New York, NY | Tactic: Harassment | Venue: Public Area |
April 22, 2025: Climate activists organized a demonstration titled “Fire Musk, Save the Planet!” outside the residence of James Murdoch in New York City. Murdoch is the son of media mogul Rupert Murdoch and is a member of Tesla’s board of directors. He had sold $13 million in Tesla stock in early March. The protesters encouraged Murdoch to advocate for the removal of Elon Musk as Tesla’s CEO, coinciding with the company’s scheduled earnings report on the same day.
| Location: New York, NY | Tactic: Harassment | Venue: Public Area |
April 22, 2025: Police in New York arrested protesters for blockading the doors to the One57 condominium building, the alleged home of Bill Ackman on “billionaire’s row.” Protesters allege Ackman was instrumental in the current administration’s campaign of retaliation against pro-Palestinian protestors.
Celebrity
| Location: Nashville, TN | Tactic: Other Crime | Venue: Home |
February 15, 2025: Shortly after posting a video of exchanging her Tesla in protest of Elon Musk in February 2025, singer and songwriter Sheryl Crow has admitted that she discovered an armed man trespassing onto her property and breaking into her barn. She said, “So, yeah, there was a moment where I actually really felt very afraid. A man got on my property, in my barn, who was armed.” Crow sold her Tesla and donated the proceeds to NPR due to her disdain for the ties between Elon Musk and the Trump Administration.
| Location: New York, NY | Tactic: Stalking | Venue: Other Restricted Area |
April 1, 2025: New York police arrested a man for allegedly making a credible threat to bomb Saturday Night Live Studios at 30 Rockefeller Plaza. The suspect’s name and age match those of a person who had allegedly been stalking actress Scarlett Johansson, who has since filed for a restraining order. A judge denied the request for a restraining order due to a technicality. The suspect faces charges of falsely reporting an incident and threatening mass harm. He pleaded not guilty to the charges. Ms. Johansson is married to a cast member of Saturday Night Live, but it is unclear if the stalker was targeting him specifically. The suspect sent a similar threat to a college in Connecticut.
| Location: Los Angeles, CA | Tactic: Other Crime | Venue: Home |
April 9, 2025: A swatting call falsely reporting a shooting at Nicki Minaj’s (born Onika Tanya Maraj) Hidden Hills residence prompted a police response. At around 7 pm, the Los Angeles County Sheriff’s Department received a report claiming a friend had shot a woman and that two armed suspects were on the scene. Deputies arrived but found no evidence of a crime, confirming the incident was likely a deliberate hoax. Ms. Minaj has previously been targeted in similar swatting calls, including three in 2023 that falsely reported child abuse, a house fire, and a shooting.
| Location: Mumbai, India | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 14, 2025: Salman Khan, a renowned Bollywood actor and director known as one of the most successful actors in India, has received a death threat from an anonymous individual who threatened to break into his house and blow up his car. The death threat follows a similar incident last year in which perpetrators associated with the Bishnoi gang fired at Salman Khan’s house. Salman Khan and his family members have received five death threats in the past two years. The threats are suspected of stemming from a hunting trip in which Salman Khan allegedly poached a blackbuck, a sacred animal in the Bishnoi community. After the poaching, Khan received warnings that if he did not travel to Rajasthan to apologize for the killing, he would be killed in retribution. The court dismissed the poaching case against Salman Khan. Mumbai police have launched an investigation into the threat.
| Location: Los Angeles, CA | Tactic: Stalking | Venue: Communication Channels |
April 16, 2024: A judge granted a temporary restraining order to former Los Angeles Rams defensive tackle Aaron Donald against a woman for stalking. Donald filed a restraining order against the woman, claiming that she began stalking and harassing him with threatening emails in 2020. Since then, she has sent packages to his home and threatened the life of his three-year-old son, Aaric, over Google Chat. Donald claims that the woman believes the two of them are married, but that he has never met her. According to a petition received through the NFL security office, the woman filed for dissolution of marriage from Donald for spousal support of $1,500 and a settlement of $6.5 million, even though they have never been married. Donald is an accomplished former NFL player who retired in March 2024.
| Location: Guayaquil, Ecuador | Tactic: Other Crime | Venue: Home |
April 22, 2025: Authorities report that men broke into the home of Ecuadorian soccer player Jackson Rodriguez, kidnapping his wife and five-year-old child. According to Rodriguez, he heard the men breaking into his home and hid under the bed. The perpetrators kidnapped his wife and child. As the kidnappers drove away, Rodriguez reported seeing a gray-colored pickup truck through the window. The incident occurred in Guayaquil, Ecuador, one of the most dangerous cities in Ecuador, known for drug smuggling and violence. The kidnapping follows a similar incident in the past year when men kidnapped Liga de Quito soccer player Pedro Perlaza in Esmeraldas, Ecuador. Police later found Pedro Perlaza alive.
| Location: Los Angeles, CA | Tactic: Other Crime | Venue: Public Area |
April 27, 2025: Social media influencer, Jack Doherty, was robbed by four individuals during an outing in Los Angeles, stealing his chains while he fought to hold onto his watch. Doherty appeared in a video recounting the incident, saying he struggled with the men as police arrived. He was with a bodyguard at the time, who was not able to stop the robbery.
| Location: Los Angeles, CA | Tactic: Other Crime | Venue: Home |
April 28, 2025: An employee working at the home of Joaquin Phoenix discovered that the actor’s $60,000 vehicle was missing and reported it stolen to the police. The 2022 Volvo SUV had been parked outside the actor’s home. Mr. Phoenix was not at home at the time, and there were no reports of injuries. LAPD filed a stolen vehicle report, but there were no reports of any leads as of 2 May 2025.
Federal Government
| Location: Minneapolis, MN | Tactic: Verbal/Written Threat | Venue: Communication Channels |
March 26, 2025: Federal agents arrested and indicted a man on charges of threatening to kill a member of Congress, leaving a voicemail with a death threat. While the identity of the member of Congress is not known, it is suspected that it was a woman. The incident follows one in 2023 in which police arrested a man for starting fires at Minneapolis mosques and vandalizing Democratic U.S. Rep. Ilhan Omar’s Congressional office. Prior to that, two men pleaded guilty for threatening to kill her. In yet another previous incident before the 2020 election, Democratic U.S. Rep. Angie Craig evacuated her office in Burnsville due to a bomb threat.
| Location: Boston, MA | Tactic: Verbal/Written Threat | Venue: Communication Channels |
March 28, 2025: A Massachusetts court charged a man for allegedly threatening to murder a United States federal official, a relative, and a relative’s spouse. According to court documents, the federal official and family members when having dinner when the official’s relative received a phone call with “No Caller ID.” When the official answered the phone, the caller confirmed the relative’s name before screaming that he would murder the family. The relative hung up, and the suspect immediately called back. Call records confirmed the suspect’s identity. Police arrived at the suspect’s home and arrested the suspect.
| Location: Lilburn, GA | Tactic: Verbal/Written Threat | Venue: Communication Channels |
March 29, 2025: Police arrested a man suspected of threatening to injure Director of National Intelligence (DNI) Tulsi Gabbard and her family. According to the complaint, the suspect allegedly sent text messages with direct threats against Gabbard and her husband. Federal agents also discovered the suspect has made similar threats on social media, posting an image of a firearm pointed at a photo of DNI Gabbard. While executing a search warrant, federal agents discovered a firearm at the suspect’s home.
| Location: United Kingdom | Tactic: Stalking | Venue: Other Restricted Area |
April 2, 2025: The number of stalkers targeting the British Royal Family has increased 11% over the past three years to 480 compared to 433 over the previous three-year period. The number of stalkers posing the highest risk level rose 46%, from 24 to 35, according to the Royalty and Specialist Protection team.
| Location: Jupiter, FL | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 4, 2025: A man faces criminal charges after allegedly posting threats to President Trump on Facebook. Police in Jupiter, Florida, learned of a “concerning Facebook post” urging someone to kill the President. The suspect’s threats against Trump occurred days before his trip to Jupiter, Florida to play golf at the National Golf Club. The Secret Service arrived at the suspect’s home and arrested him. The court denied him bail.
| Location: Mandera County, Kenya | Tactic: Other Crime | Venue: Public Area |
April 7, 2025: A group of five Kenyan officials kidnapped near the border with Somalia by gunmen from the Al-Qaeda-linked group al Shabaab, were released following two months in captivity. Al Shabaab is fighting to overthrow the government of Somalia and establish its own Islamic polity. The group regularly engages in cross-border attacks in Kenya to retaliate for the Kenyan military’s efforts to combat the jihadist group.
| Location: Dallas, TX | Tactic: Other Crime | Venue: Public Area/td> |
April 7, 2025: A man faces charges for allegedly threatening to kill U.S. Immigration and Customs Enforcement (ICE) agents online. The suspect posted threats on Facebook, according to the FBI. When confronted, the suspect said he was serious about the threats. He has also made threats against Texas Governor Greg Abbott and U.S. Secretary of Homeland Security Kristi Noem.
| Location: Jerusalem, Israel | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 9, 2025: Israeli authorities are investigating threatening letters sent to members of Prime Minister Benjamin Netanyahu’s coalition, which claimed that if the lawmakers did not vote as they were told, their families would be harmed. The Lahav 433 National Unit for International Crimes is leading the investigation. According to lawmakers, they received “unusual” letters that contained personal information about family members and threats to cause them harm if the lawmakers did not vote in a certain way. The hazardous materials unit, bomb squad, and hospital services were dispatched to the scene. The letter listed wives, daughters, nieces, and nephews, while stating that “children and grandchildren would be harmed in relation to the number fallen.” The communications are similar to previous threatening letters attributed to “The Israeli Avengers” organization in 2024, in which the letters attempted to hold the government responsible for failing to protect the Israeli people and prevent the Hamas attack on October 7, 2023.
| Location: Waukesha County | Tactic: Attack | Venue: Communication Channels |
April 9, 2025: A teen in Wisconsin allegedly killed his parents to obtain the economic means needed to kill President Donald Trump and overthrow the U.S. government. Authorities charged the suspect with first-degree murder, hiding a corpse, theft of property, and misappropriating an ID. According to court documents, investigators are pursuing federal charges that include “conspiracy, presidential assassination, and use of weapons of mass destruction.” Police found the teen’s parents dead inside their home. During the search warrant, the sheriff’s department found information on the teen’s phone that connected him to “The Order of Nine Angles,” a network of Satan-worshipping neo-Nazi extremists. Law enforcement discovered documents that unveiled plans to kill President Trump and start a revolution that would “save the white race.” The documents included images of Adolf Hitler. However, according to the FBI, the teen may not have acted alone. He was allegedly in communication with “other parties” about his plans. These “other parties” supported his plans to kill President Trump and overthrow the U.S. government. The teen also bought a drone and explosives to carry out the attack. The next court date is set for May 7, 2025, for an arraignment.
| Location: Albuquerque, NM | Tactic: Attack | Venue: Other Restricted Area |
April 14, 2025: Federal authorities filed charges against an Albuquerque man suspected of carrying out two separate arsons. At the site of the first attack, against a Tesla dealership, federal investigators found graffiti spray-painted onto vehicles that said, “Die Elon,” “Tesla Nazi Inc,” and “Die Tesla Nazi,” with swastika symbols. The following month, the man attacked the Republican Party of New Mexico’s office, and police identified graffiti on the side of the building with the phrase “ICE=KKK.” Federal investigators linked the two occurrences through surveillance and evidence of homemade incendiary devices made by the same individual.
| Location: USA | Tactic: Harassment | Venue: Home |
April 14, 2025: An unknown actor is sending pizzas to the homes of federal judges as an act of intimidation, placing the orders in the name of the murdered son of federal Judge Esther Salas from New Jersey. Salas claims that she, her colleagues, and her adult children have all received the pizzas. A man with a case before Judge Salas murdered her son and wounded her husband while attempting to kill her at her home in 2020. When asked about the twisted intimidation tactic, Judge Salas said: “What does that say to those judges?” Salas said. “It says I know where you live. I know where your kids live. And do you want to end up like Judge Salas? Do you want to end up like her son? These are unprecedented attacks on judicial officers.”
| Location: Washington, D.C. | Tactic: Other Crime | Venue: Public Area |
April 20, 2025: A homeless man wearing a surgical mask stole Secretary of Homeland Security Kristi Noem’s purse while she was having dinner at a downtown restaurant in Washington, D.C. The U.S. Secret Service reviewed security camera footage and reported that the man stole her bag before leaving the restaurant. Noem’s bag contained her “driver’s license, medication, apartment keys, passport, DHS access badge, makeup bag, blank checks, and $3,000 in cash.” The man was subsequently arrested, but the incident raises concerns over the security of Secretary Noem, a high-threat target due to her position as the Secretary of Homeland Security.
| Location: Balashikha, Russia | Tactic: Attack | Venue: Public Area |
April 25, 2025: Lt. Gen. Yaroslav Moskalik, the deputy head of the main operations directorate of the general staff of the Russian armed forces, died in a car explosion near Moscow. The explosion was reportedly similar to previous Ukrainian attacks on Russia. Russia’s Federal Security Service has detained a suspected agent of the Ukrainian special services. The attack follows an explosion that killed Lt. Gen. Igor Kirillov after a scooter detonated near the entrance to his residence last year.
| Location: United Kingdom | Tactic: Verbal/Written Threat | Venue: Public Area |
April 27, 2025: The Metropolitan police are investigating footage of Kneecap, a West Belfast rap group, allegedly calling for the death of British MPs, saying, “The only good Tory is a dead Tory. Kill your local MP.” Police are examining another video that showed a band member say, “Up Hamas, Up Hezbollah” at a performance in London. On social media, Kneecap defended their statements by claiming that they are facing a “coordinated smear campaign.” Hamas and Hezbollah are both banned in the UK. According to the UK government, claims against elected officials constitute a threat to democracy. Earlier in April, Kneecap allegedly displayed messages about the war in Gaza, resulting in the revocation of their U.S. visas. Multiple music festival organizers have subsequently canceled Kneecap performances.
| Location: Brisbane, Australia | Tactic: Harassment | Venue: Office |
April 29, 2025: Australian authorities have charged a teenage suspect with vandalizing the office of Australian opposition leader of the Liberal Party, Peter Dutton. Police accused the suspect of splattering the office in red paint on three different occasions. Police say that four people fled the site upon their arrival, but that the dog squad tracked a teenage woman. Dutton has sparked controversy over his comments on ceremonial Aboriginal rites, “finding common ground” with President Trump, and his connections to billionaires. People have vandalized Dutton’s office in the past, writing the words “maggot” and “scum” on a smashed window, while splattering paint. The incident occurred in the lead-up to the national Australian elections on May 3, 2025.
| Location: Nairobi, Kenya | Tactic: Attack | Venue: Public Area |
April 30, 2025: Gunmen on a motorcycle shot a Kenyan member of parliament, Charles Ong’ondo Were, near a busy roundabout in Nairobi. Police say the attackers had followed Were’s vehicle before shooting him at close range. His bodyguards and driver rushed him to the hospital, where he died at the scene. Were, a member of the Orange Democratic Movement, complained about receiving death threats two months ago. While the motive for the killing is unclear, Ware had stated that some “hired goons” were planning to kill him over his political views. Ware had spoken out against the violence and unrest in the Kasipul constituency in Western Kenya. An investigation is ongoing, and police say that the assassination appeared to be targeted.
| Location: London, UK | Tactic: Attack | Venue: Other Restricted Area |
April 30, 2025: London police detained a man for trying to break into the Israeli Embassy in London with a knife. Police charged him with terrorism and possession of a bladed weapon. Police do not believe there is a wider threat to the public. Multiple attacks and attempted attacks on Israeli Embassies have occurred since the war in Gaza. The incident follows an attack on an Israeli Embassy in Sweden that Swedish Intelligence suspects Iran may have been involved.
State Government
| Location: Chicago, IL | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 4, 2025: Illinois State Representative Terra Costa Howard received death threats in response to her introduction of a bill to increase oversight of homeschooling, requiring parents to file declarations of intent and allowing officials to request lesson plans during truancy investigations. The bill, motivated by cases of educational neglect, faced strong opposition from homeschooling advocates who raised concerns about privacy and government overreach. Costa Howard reported receiving threats, including an anonymous letter perceived as a death threat, which she turned over to law enforcement for investigation.
| Location: Terre Haute, IN | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 10, 2025: Authorities arrested two individuals after they allegedly made threats against Indiana State Representative Jim Lucas. The suspects reportedly sent threatening messages both through voicemails and on Facebook to Lucas following his recent legislative actions. Law enforcement officials investigated the threats and charged the suspects with four counts of felony intimidation.
| Location: Harrisburg, PA | Tactic: Attack | Venue: Home |
April 12, 2025: Pennsylvania Governor Josh Shapiro’s Residence was set on fire while his family was asleep inside. Authorities arrested an individual who allegedly scaled the security fence, broke windows, and ignited Molotov cocktails in the residence’s south wing. The suspect is facing multiple charges, including attempted murder and terrorism, and reportedly expressed intent to harm the governor, citing political and religious grievances. The fire caused significant damage to the historic mansion, but no injuries were reported.
| Location: Puducherry, India | Tactic: Verbal/Written Threat | Venue: Communication Channels |
April 18, 2025: An anonymous email threatened to bomb Raj Nivas, the official residence of Puducherry’s Lieutenant Governor. Authorities swiftly evacuated the premises and conducted a thorough search, finding no explosives and deeming the threat a hoax. Cybercrime investigators traced the email’s origin to servers outside India, prompting local police to seek assistance from central cybercrime agencies. In response to this and similar recent threats, officials have enhanced digital surveillance and issued public advisories to report suspicious communications.
Local Government
| Location: Holloway, OH | Tactic: Verbal/Written Threat | Venue: Office |
February 6, 2025: An individual threatened to blow up the Belmont County Courthouse, which led to a temporary lockdown of the courthouse and heightened security. Authorities charged the individual with inducing panic and aggravated menacing after his comments raised concerns. The individual called the courthouse upset about an increase in property taxes reflected in the bills issued this month. The threat prompted immediate action from law enforcement to protect public safety and the courthouse.
| Location: Barangay Illuru Sur, Philippines | Tactic: Attack | Venue: Public Area |
April 23, 2025: Rizal Cagayan’s Mayor Joel Ruma was fatally shot during a campaign event in Barangay Illuru Sur. A suspected gunman opened fire, killing Ruma and injuring three others. The incident marks the latest in a series of election-related violence in the region. Authorities are investigating the shooting as part of broader concerns over political violence leading up to the 12 May elections.
| Location: Jalisco, Mexico | Tactic: Attack | Venue: Public Area |
April 29, 2025: While dining at a seafood restaurant in Jalisco, gunmen shot and killed Jose Luis Pereira, Secretary General of the Teocaltiche City Council. Senator Alejandro Moreno and the Teocaltiche Municipal Administration called the attack a “cowardly murder” on social media and noted the lack of action from the Jalisco and federal governments.
Community Leader
| Location: Motherwell, South Africa | Tactic: Other Crime | Venue: Public Area |
April 10, 2025: The South African Police Service confirmed that four armed and masked men allegedly kidnapped Josh Sullivan, an American missionary, while he was giving a sermon. During the sermon, the men entered the church, robbed Sullivan, and kidnapped him at gunpoint. The incident is the latest in a series of recent kidnappings in the Gqeberha region. Sullivan was rescued by police on April 15.
| Location: Quetzaltenango, Guatemala | Tactic: Attack | Venue: Public Area |
March 21, 2025: The community of Quetzaltenango has called on Guatemalan authorities to investigate the killing of Ismael Alonzo González, a community journalist for Despertar Occidental and member of the Association of Journalists and Communicators of the Southwest. While standing outside his home, two men dressed in black approached him and shot him. The men escaped into the woods, and they are still at large. The motive for the killing remains unclear; however, community members believe that the killing is tied to his journalism.
| Location: Ukraine | Tactic: Attack | Venue: Public Area |
April 30, 2025: The Security Service of Ukraine (SSU) detained a woman who attacked Ukrainian lawyer and activist Serhiy Sternenko with a handgun as he left his home. The woman stood next to the door to Sternenko’s residence waiting for his departure, and as his protective detail was walking him from the door to his vehicle, she drew a pistol from her purse and shot the activist in the back. The detail agents responded and disarmed the woman. This was the fourth assassination attempt against Sternenko, who has been targeted by pro-Russian groups for his anti-Russian stance. Since the 2022 full-scale invasion, Starnenko has been very involved in manufacturing FPV drones for the Ukrainian armed forces. An investigation into the attack is ongoing.