February 2026 TorchStone Global Monthly Executive Protection Report
TorchStone Global believes that broader situational awareness and intelligence are key to providing quality executive protection—whether the principal is a Fortune 500 CEO, international celebrity, or local city council member. Our monthly executive protection report catalogues incidents we have captured through our open-source searches that are relevant to the practice of executive protection. We hope the report will serve as a centralized source of threat activity to provide insight into current trends in threats to high-profile individuals.
For more information on customized threat tracking for at-risk individuals, threat assessments, executive protection, or other security services, please contact us.
Quick Links
Summary
The TorchStone Executive Protection Report tracked 15 domestic and 15 international security incidents or updates to prior incidents impacting high-profile individuals during the month of February. Below are some key incidents of note over the past month.
Several incidents in February highlight evolving threats to high-visibility individuals and underscore the continued importance of layered residential security and protective intelligence.
First, attacks targeting celebrities outnumbered those against any other target category in February, with many incidents involving home invasions and burglaries. These crimes occurred both domestically and internationally, reinforcing the global nature of the threat. For example, on February 7, AJ Edelman, the driver for Israel’s national bobsled team, revealed that intruders robbed his team’s apartment while they were training for the 2026 Winter Olympics. Similarly, on February 14, criminals burglarized the San Fernando Valley home of social media influencer Kristie Cook (alias Spill Sesh). These incidents underscore the importance of strong residential security measures, discretion around travel schedules, and proactive monitoring of publicly available information that may expose when residences are unoccupied.
A deeply concerning and ongoing case from February involved the suspected kidnapping of Nancy Guthrie, the mother of NBC Today Show host Savannah Guthrie. On February 1, Tucson police declared Guthrie missing after her family lost contact with her in the early morning hours. Investigators determined that Guthrie’s Ring doorbell camera had been disabled shortly before motion was detected by other surveillance systems inside the home. Although authorities have released Ring camera footage showing a suspect and recovered a glove believed to belong to the individual, no arrests have been made; Guthrie remains missing and the investigation is ongoing. The incident highlights the potential for targeted attacks against family members of high-profile individuals.
Finally, a January case provides an important reminder of the value of residential surveillance technology in threat detection and investigation. Earlier reporting noted that a Ring doorbell camera at the residence of U.S. Office of Management and Budget Director Russell Vought captured a man wearing gloves, sunglasses, and a surgical mask while appearing to conceal a firearm. A witness called police, but the suspect fled before officers arrived. On January 16, 2026, authorities identified and arrested the individual on charges of attempted murder. This case illustrates how integrated home security technologies can provide critical investigative leads, even when suspects initially evade capture. The incident also parallels elements of the Guthrie case, where similar technology provided key evidence despite efforts to disable it.
Together, these cases reinforce three key protective intelligence considerations: the persistent targeting of high-visibility individuals at their residences, the vulnerability of family members and personal spaces, and the growing importance of integrated residential security systems in both deterrence and post-incident investigation.
Business Executive
| Location: Kimberley, Nottinghamshire, UK | Tactic: Other Crime | Venue: Home |
December 4, 2025: Five men broke into the gated home of HVAC business owner Matthew Simpson and stole his watch collection as well as some of his wife’s valuable handbags. The men entered the home by breaking the patio door with a sledgehammer. Simpson attempted to confront the men but was seriously injured and eventually allowed them to access the safe containing his watches. Police arrested the suspects on February 27, and investigations into their motives are ongoing. Simpson claimed that the robbery was targeted by a personal connection since he never displayed his valuable belongings in public or on social media.
| Location: Valence, France | Tactic: Attack | Venue: Home |
February 6, 2026: French authorities arrested six suspects following the rescue of a local magistrate and her mother after an apparent kidnapping for ransom plot targeting a cryptocurrency investor. A French prosecutor told the press that the kidnappers targeted the woman and her mother at their home near Valence, in the southeast of France, over the night of January 4–5. The victim’s partner, who holds a senior position in a cryptocurrency start-up, reported receiving a photo of her along with a demand for an undisclosed ransom to be paid in cryptocurrency. Ultimately, residents reported concerning noises coming from a garage in Bourg-les-Valence, where the captors had detained the two women for over 30 hours. Police responded and freed the women, who both suffered minor injuries. The kidnappers threatened to mutilate the victims if the transfer was not made.
| Location: London, UK | Tactic: Attack | Venue: Home |
February 8, 2026: Criminals broke into former Nottingham Forest Football Club owner Fawaz Al-Hasawi’s Mayfair residence. The exact cost of property damage or stolen property is not yet known. The criminals attacked the sleeping Kuwaiti businessman when they entered his bedroom during the intrusion. Al-Hasawi sustained non-fatal knife wounds from the attack that nevertheless required hospital attention. In addition to his high-profile, Al-Hasawi was known to routinely post images of his luxury watch collection on his social media accounts, which may have made him a target to criminals.
| Location: Los Angeles, CA | Tactic: Other Crime | Venue: Home |
February 18, 2026: Police arrested a member of Fanatics CEO Michael Rubin’s personal staff for allegedly stealing from his Hollywood Hills residence. Authorities did not specify what the staffer stole or her working relationship with Mr. Rubin. While Mr. Rubin was in Los Angeles at the time of the incident, he had not contacted law enforcement directly. The incident highlights the risk of insider theft to high-net-worth families and residences, as well as the threat of address exposure from media coverage.
Celebrity
| Location: Cheshire, UK | Tactic: Other Crime | Venue: Home |
January 28, 2026: Burglars ransacked the mansion of reality TV host Maya Jama and Manchester City footballer Rúben Dias while both were away. Although the home employed sophisticated alarm, camera, and gate systems, the absence of the couple allowed the burglars to escape with a currently unknown quantity of valuable belongings.
| Location: London, UK | Tactic: Other Crime | Venue: Public Area |
January 29, 2026: Robbers stole renowned fashion designer Catalin Botezatu’s £2 million watch while he travelled through Berkeley Square at night. London Metropolitan Police arrested the suspect early in the morning of January 30; it is currently unknown whether the watch was successfully recovered or not.
| Location: Los Angeles, CA | Tactic: Other Crime | Venue: Home |
January 30, 2026: Two male suspects smashed windows and burglarized Suits actress Gina Torres’ Sherman Oaks residence around 7:10 p.m. local time. The suspects stole more than $225,000 USD in cash and jewelry and fled in a white sedan; a neighbor observed them loading bags into the vehicle and notified authorities. LAPD officers responded, searched the area, and filed a burglary report. The investigation remains active, with no arrests reported as of early February.
| Location: Tucson, AZ | Tactic: Attack | Venue: Home |
February 1, 2026: Police declared Nancy Guthrie, the mother of NBC Today Show host Savannah Guthrie, as missing after her family lost contact with her in the early hours of the morning. Specifically, investigations revealed that Guthrie’s Ring doorbell camera was disabled in the early morning, followed by motion detected by additional surveillance systems in the home and the disconnection of Guthrie’s pacemaker app from her phone. Guthrie’s blood was also found on the porch. TMZ and national news affiliate stations received the first ransom letters targeting Guthrie on February 3, which demanded a bitcoin quantity worth millions of U.S. dollars. Although not initially revealed to the public, one of the notes issued two deadlines for payment: the first on February 5 at 5 p.m., the second on February 9 at an unspecified time. Although investigators revealed Ring camera footage featuring a suspect to the public and a glove identified as belonging to the suspect was recovered from the scene, no suspects have been identified. Guthrie remains missing, and investigations are ongoing.
| Location: Ahmedabad, India | Tactic: Verbal/Written Threat | Venue: Communication Channels |
February 5, 2026: Musician Dharmesh Chavda filed a criminal complaint after he received a phone call threatening him with physical harm and death. Chavda claimed that the caller revealed their identity, but the validity of that identity has not yet been confirmed.
| Location: Milan, Italy | Tactic: Other Crime | Venue: Restricted Area |
February 7, 2026: AJ Edelman, the driver for Israel’s national bobsled team, revealed that intruders robbed his team’s apartment while they were training for the 2026 Winter Olympics. The apartment purportedly contained the teams’ passports as well as “thousands of dollars” of personal belongings. Although the apartment is in an undisclosed European location outside of Italy, Edelman was in Milan at the time of the robbery.
| Location: San Francisco, CA | Tactic: Attack | Venue: Restricted Area |
February 9, 2026: An unknown assailant shot San Francisco 49ers defensive end Keion White in the leg after he had a verbal confrontation with rapper Dominique Jones (alias Lil Baby) at a nightclub party. An investigation is ongoing. Despite his injury, White did not disclose the identity of his assailant to authorities.
| Location: Los Angeles, CA | Tactic: Other Crime | Venue: Home |
February 14, 2026: Thieves burglarized the home of social media influencer Kristie Cook (alias Spill Sesh) in the San Fernando Valley. Cook was not home at the time of the incident in which the suspects managed to access her residence through a back wooden door. The suspects ransacked the residence and left with several items, including a large Buddha statue which they smashed in the driveway. Police are investigating whether the incident was a hate crime.
| Location: Miami, FL | Tactic: Other Crime | Venue: Home |
February 14, 2026: Two burglars stole TikTok influencer Carlos Nunez’ Ferrari—valued around $500,000 USD—from his garage early in the morning. Nunez confronted the burglars as they attempted to steal his Mercedes G-Wagon from the same garage, causing them to flee the scene in the Ferrari. Authorities found a white Mercedes driven by the burglars at the scene. An investigation is ongoing, but the Ferrari is still missing.
| Location: Milan, Italy | Tactic: Other Crime | Venue: Public Area |
February 15, 2026: Jonathan Owens, Safety for the Chicago Bears and husband of gymnast Simone Biles, revealed that a robber attempted to steal his shopping bag from him while he was traveling through Milan during the 2026 Winter Olympics. The robber failed to take the bag since Owens made sure to wrap its straps around his wrist multiple times. In discussing the incident on social media, Owens credited anecdotes from TikTok for preparing him for attempted thefts while travelling abroad.
| Location: New York, NY | Tactic: Attack | Venue: Public Area |
February 16, 2026: A group of four people assaulted Cleveland Browns Safety Ronnie Hickman after he ignored them while passing through the lobby of his hotel. The group absconded following the encounter, and Hickman was taken to a local hospital to assess his injuries. An investigation into the suspects’ identities is ongoing.
| Location: Vienna, Austria | Tactic: Verbal/Written Threat | Venue: Restricted Area |
February 16, 2026: Prosecutors filed terrorism charges against an incarcerated man who allegedly orchestrated the terrorism plot that led to the cancellation of Taylor Swift’s Vienna concerts in August 2024. Authorities identified the suspect as an affiliate of the Islamic State.
| Location: Los Angeles, CA | Tactic: Stalking | Venue: Home |
February 18, 2026: Los Angeles Police were called to the home of model and social media influencer Lindsey Pelas on two separate occasions between February 18–19. The first response occurred just before midnight on February 18, issued for a possible restraining order violation made by an individual spotted in the residence’s yard. The second response occurred later in the afternoon of February 19 after a man was spotted in both Pelas’ front and back yards; authorities filed a trespassing report, but no further action was taken. Despite the suspicious circumstances, police claimed that the incidents were likely unrelated.
Federal Government
| Location: Arlington, VA | Tactic: Attack | Venue: Home |
August 10, 2025: A Ring doorbell camera at U.S. Office of Management and Budget (OMB) Director Russell Vought’s house captured a man wearing gloves, sunglasses, a surgical mask, and who appeared to be concealing a firearm. A witness called police to the scene, but the suspect managed to successfully escape before search efforts were initiated. Police eventually identified the man and arrested him on January 16, 2026, for attempted murder. During consequent investigations—in addition to the discovery of a manifesto written by the suspect explicitly targeting Vought for murder—the suspect admitted to past violent comments targeting federal government officials and expressed admiration for Luigi Mangione, murderer of former UnitedHealthcare CEO Brian Thompson.
| Location: Portland, OR | Tactic: Verbal/Written Threat | Venue: Public Area |
January 31, 2026: An armed suspect threatened uniformed security officers at a grocery store after falsely claiming to be a U.S. Secret Service agent and attempting to fire a handgun. The suspect also carried a shotgun; messages that included threats to President Donald Trump were written on shells recovered from the scene. On February 5, 2026, police fatally shot the suspect at his residence after he resisted arrest.
| Location: Arauca, Colombia | Tactic: Attack | Venue: Public Area |
February 5, 2026: Multiple gunmen ambushed Colombian senator Jairo Castellanos and his security detail on a rural road. Castellanos was unharmed, but the gunmen killed two of his guards in the resulting shootout. The assailants operated in an area traversed by known armed criminal organizations, but none have taken responsibility for the attack so far. Although Castellanos was not in the vehicle during the shootout, the attack was likely connected to ongoing political and conflict-related violence in eastern Colombia, where threats against local and national political figures regularly occur.
| Location: Moscow, Russia | Tactic: Attack | Venue: Public Area |
February 6, 2026: An assailant shot and wounded Russian Lieutenant General Vladimir Alexeyev multiple times after breaking into his residential block, leaving him in critical condition. Although Russian officials accused Ukrainian spies of arranging the attack, authorities have yet to identify a suspect.
| Location: Nairobi, Nigeria | Tactic: Verbal/Written Threat | Venue: Communication Channels |
February 9, 2026: A man arrived at a court hearing for reportedly sending death threats to Senator Hezena Lemaletian via WhatsApp on January 27. Although the authorities ran forensic analyses on the suspect’s phones and SIM cards, the court magistrate ruled against keeping him detained. Investigations are ongoing.
| Location: Palm Beach, FL | Tactic: Other Crime | Venue: Restricted Area |
February 22, 2026: United States Secret Service agents shot and killed an armed intruder who entered the secure perimeter of President Donald Trump’s Mar-a-Lago residence. The agents shot the intruder after he failed to comply with their orders and aimed his shotgun at them. Further investigation into the intruder’s background revealed that he had no prior criminal history in his home state.
State Government
| Location: St. Cloud, MN | Tactic: Attack | Venue: Home |
February 7, 2026: Minnesota politician Jeff Johnson withdrew from the state’s gubernatorial race after his daughter was stabbed to death at her residence. The daughter’s husband was at home at the time and also suffered stab wounds which were likely self-inflicted.
| Location: Cebu, Philippines | Tactic: Verbal/Written Threat | Venue: Communication Channels |
February 9, 2026: A source connected to Cebu Governor Pamela Baricuatro notified authorities of an individual planning to harm or kill the governor and her family. Provincial police units have tightened security around Cebu’s capitol building; no suspects have been identified yet, but police are currently monitoring a criminal group suspected of running a hired gun operation.
Local Government
| Location: Springfield, OH | Tactic: Verbal/Written Threat | Venue: Office |
February 9, 2026: Clark County schools and public offices received emailed bomb threats targeting the city’s Haitian community, forcing the Springfield City School District to close classes for the day. Local law enforcement cleared the county’s buildings of threats, and the FBI further confirmed that the threats were hoaxes.
| Location: Chickamauga, GA | Tactic: Verbal/Written Threat | Venue: Communication Channels |
February 9, 2026: An individual issued a threat of violence to Chickamauga Mayor Trey Deck in a call to a local law firm. Deck received the threat before a hearing on his potential removal from office due to multiple misconduct allegations. In response, Deck abstained from appearing at his upcoming hearing and was instead represented by his legal counsel.
Community Leader
| Location: Brisbane, Australia | Tactic: Attack | Venue: Home |
January 12, 2026: Police found folk musician and music therapist Velvet Pesu dead in her home with sustained injuries. No one else was present at the time of the initial investigation; however, police arrested one of Pesu’s clients living on the premises for reckless driving later in the afternoon. An investigation is ongoing.
| Location: Potomac, MD | Tactic: Attack | Venue: Home |
February 14, 2026: A man fatally shot millionaire philanthropist Robert Fuller after breaking into his assisted living apartment. On February 25, the suspect opened fire on a state trooper during a traffic stop before leaving the scene; investigators matched the spent casings from the scene to those found at Fuller’s apartment. Authorities finally apprehended the suspect later that same day when he arrived at court for an unrelated traffic charge. Authorities identified the suspect as an employee of Fuller’s assisted living complex.
| Location: Tel Aviv, Israel | Tactic: Harassment | Venue: Home |
February 21, 2026: A controversial right-wing commentator entered the apartment complex of Arab-Israeli news anchor Lucy Aharish. The commentator brought a megaphone to the premises and threatened Aharish due to recent comments that she made in support of Arab-Israeli opposition of the Israeli government. Police detained the commentator for disturbing the peace after Aharish’s partner verbally confronted him.