January 2025 TorchStone Global Monthly Executive Protection Report
TorchStone Global believes that broader situational awareness and intelligence are key to providing quality executive protection—whether the principal is a Fortune 500 CEO, international celebrity, or local city council member. With that in mind, we are launching our monthly executive protection report, cataloging incidents we have captured through our open-source searches that are relevant to the practice of executive protection. We hope the report will serve as a centralized source of threat activity to provide insight into current trends in threats to high-profile individuals.
For more information on customized threat tracking for at-risk individuals, threat assessments, executive protection, or other security services, please contact us.
Quick Links
Summary
The TorchStone Executive Protection Report tracked 22 domestic and 22 international security incidents or updates to prior incidents impacting high-profile individuals during the month of January. Below are some key incidents of note over the past month.
- The December murder of United HealthCare CEO Brian Thompson continued to reverberate in the new year. Social media users have turned the shooter’s name into a euphemism for assassination and influencers have openly called for more attacks against CEOs. For example, independent singer/songwriter Ethel Cain promoted the hashtag #KillMoreCEOs in early January. Users reposted the hashtag hundreds of times in the following weeks, sometimes including the names of specific CEOs they thought should be targeted. Later in the month, U.S. Capitol Police arrested a man armed with incendiary devices and a knife who said that he wanted to kill new members of President Trump’s cabinet. He cited Brian Thompson’s killer as inspiration for his attempted attack.
- Federal government buildings were high-profile targets early in January when Capitol Police arrested two individuals for posing a threat to the Capitol building on January 8 while President Jimmy Carter was lying in state. First, Capitol Police arrested a man trying to enter the Capitol visitor center with a machete and multiple edged weapons. Then, later that same day, Capitol Police arrested a second man after he lit a bag on fire and placed it on top of his vehicle outside the Grant Memorial in front of the U.S. Capitol Building. Investigators found accelerants inside the bag, suggesting that the man intended to start a larger fire. Despite calls for protest, the January 20 inauguration ceremony did not experience any significant disruptions.
- Professional thieves continued to target the homes of prominent athletes during away games. On January 11, thieves broke into the home of Evgeni Malkin and stole three Stanley Cup championship rings while his team was playing consecutive games in Canada. Additionally, Malkin’s home security system had been down during the burglary. The incident and at least a dozen previous incidents just like it reinforce the importance of ensuring that home security systems are installed and functioning.
Business Executive
| Location: Wendell, NC | Tactic: Verbal/Written Threat | Venue: Communication Channels |
December 6, 2024: Authorities arrested a man suspected of writing threatening messages towards executives of Advance Auto Parts and their families. The suspect allegedly demanded executives improve the accuracy of their website search function by the end of December, or, as an expert sniper, he would violently target executives and their families. Authorities found a picture of a rifle on the suspect’s cellphone and text messages in which he admitted he would have murdered United Healthcare CEO Brian Thompson if given $50,000 and an untraceable rifle. If convicted, he could face up to five years in prison.
| Location: Online Threat | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 10, 2025: Indie singer/ songwriter Ethel Cain used the hashtag #KillMoreCEOs in response to a post from former Secretary of Labor Robert Reich about the influence of money in politics. Cain shared her thoughts on the UnitedHealthcare CEO killing of Brian Thompson by alleged shooter Luigi Mangione, stating that violence is the only answer to hold corporations accountable. Since the UnitedHealthcare incident, Mangione has gained a prominent online following of individuals similarly angry with corporate America and the healthcare industry. Cain called her fans to violence and suggested that they should follow Luigi Mangione’s example, claiming that killing CEOs and “making them fear” is the only solution to counter the injustices of corporate America.
| Location: Dubai, UAE | Tactic: Stalking | Venue: Communication Channels |
January 14, 2025: The Israeli National Security Council (NSC) warned that Iranians are targeting Israelis online, recruiting them to carry out espionage or plot attacks on behalf of Iran. The warning comes as the NSC uncovered a plot earlier in 2025 in which an Israeli businessman received a request on Telegram to fly to Dubai for a meeting to take part in an interview. The businessman alerted the NSC, discovering that the contact infected his cellphone with malware. The NSC cautions Israelis against sharing information with unknown contacts online and disclosing personal details with any potential partners without verifying identities.
| Location: Paris, France | Tactic: Other Crime | Venue: Home |
January 21, 2025: David Balland, a co-founder of a French cryptocurrency firm known as Ledger, suffered a mutilated hand after attackers kidnapped Balland and his wife. Police are questioning 10 people for involvement in the crime. The kidnappers contacted another Ledger co-founder for ransom paid in cryptocurrency. The rescue operation involved over 90 officers from France’s elite tactical units. Police traced and seized nearly all cryptocurrencies paid to the kidnappers.
Celebrity
| Location: Sibu, Sarawak, Malaysia | Tactic: Verbal/Written Threat | Venue: Communication Channels |
December 30, 2024: After performing at the 2025 Malaysian New Years’ Eve celebration, Malaysian singer Nor Ashimah Ramli reported that she received a death threat on Facebook. Nor Ashimah Ramli is a YouTube star popularly known as “Baby Shima.” She has earned over 1.3 million subscribers from posting live singing performances on her YouTube channel. The suspect denied having made the threat, claiming to be under the influence of alcohol, and faces seven years of jail time if charged. The Magistrate’s Court fined the suspect RM4,000.
| Location: Mae Sot, Thailand | Tactic: Attack | Venue: Public Area |
January 3, 2025: A Chinese actor, known as Xingxing, went missing in the Thai border town of Mae Sot, prompting fears that he may have fallen victim to human trafficking on the Thai Myanmar border. According to his girlfriend, Xingxing had learned of a film project in an online actors’ chatroom, auditioned, added the production coordinator on WeChat, and decided to go to Thailand to join the shoot. In Thailand, he boarded a vehicle arranged by the coordinator, sharing his location with his girlfriend, until he went missing near the border. Another Chinese actor, Xu Dajiu, reported he narrowly escaped a similar situation. He speculated that Xingxing was taken to Myawaddy, an area that has emerged as a center for cyber scams, human trafficking, online gambling, organ harvesting, prostitution, and drugs. Xu Dajiu warned against accepting offers to film in Thailand, claiming such opportunities often lead to exploitation in Myanmar.
| Location: Birkenhead, UK | Tactic: Stalking | Venue: Communication Channels |
| Location: India | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 6, 2025: After receiving life-threatening commentary on social media and severe online harassment, Nidhhi Agerwal has filed a cybercrime complaint. Nidhhi Agerwal is an Indian actress known for her work in Telugu, Tamil, and Hindi films. Agerwal has participated in Miss Diva Universe 2014 and won several awards for “Best Female Debut.” She reports that a user directed threats against her life and family, while also targeting her reputation. According to Nidhhi Agerwal, the user mentioned others in his commentary to amplify the intimidation, demonstrating an attempt to harm. She claims that the actions constitute cyber harassment, criminal intimidation, and defamation.
| Location: Sonora, Mexico | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 7, 2025: Authorities in Mexico are offering state protection to famed regional singer Natanael Cano and other artists after a drug cartel publicly threatened them in Northern Mexico. Photos of a banner threatening the lives of Cano, a singer of corridos, a musical genre often linked to drug cartel violence, and several other artists in the Sonora region circulated on social media. Jalisco Matasalas, a group within a faction of the Sinaloa cartel, signed the banner, accusing the singers of financially supporting a rival gang known as Salazares. The threats against Cano follow a surge of violence in Sinaloa triggered by the capture of Cartel boss Ismael “El Mayo” Zambada.
| Location: Los Angeles, CA | Tactic: Harassment | Venue: Communication Channels |
January 9, 2025: Megan Thee Stallion, whose legal name is Megan Pete, secured a five-year civil restraining order against Tory Lanez following a hearing before a Los Angeles judge. The order addresses Ms. Pete’s ongoing concerns for her safety, stemming from a 2020 incident in which Lanez, born Daystar Peterson, shot her. Despite his current 10-year prison sentence, Ms. Pete’s legal team argued that Mr. Peterson has continued to intimidate and harass her from behind bars. The restraining order prohibits Mr. Peterson from contacting or harassing Ms. Pete for the next five years.
| Location: South Korea | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 9, 2025: Actress Bae Seul-ki pressed legal charges after receiving a death threat against her and her family online. The content of the threat was allegedly “so indescribably awful that the family currently cannot carry on their lives as normal.” The perpetrators have unsubscribed from the online community where the post originated and deleted the URL of the death threat. Bae began her career as a singer, and she is best known for several lead roles in South Korean dramas. She is married to YouTuber Shim Lee-seobin.
| Location: Mexico | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 11, 2025: Karla Sofia Gascón, the first trans woman nominated for best actress for her performance in the Oscar-winning film Emilia Pérez, has received life-threatening messages. She has received death threats in Spain and Mexico, including messages that she would be found dismembered in a bag. Gascón’s success has prompted backlash from anti-trans activists, far-right groups, and politicians.
| Location: Sewickley Heights, PA | Tactic: Other Crime | Venue: Home |
January 11, 2025: National Hockey League star Evgeni Malkin reported that his home had been broken into in the Sewickley Heights area of Pittsburgh. The thieves allegedly stole Malkin’s Stanley Cup rings. Malkin’s home security system had been down during the burglary. Several burglaries of the homes of celebrity athletes have occurred, and the FBI warns pro athletes that the robberies are connected.
| Location: India | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 12, 2025: Indian actress Honey Rose took legal action against activist Rahul Easwar over cybercrime and continuous threats. Rose shared on Facebook that she and her family have endured severe mental stress resulting from Rahil Easwar. She accused Easwar of allegedly orchestrating a cybercrime to trivialize her complaint and harm her reputation. The complaint follows legal action against Boby Chemmanur for sexual harassment, leading to the businessman’s arrest in Wayanad, district of Kerala, India.
| Location: Sargodha, Pakistan | Tactic: Attack | Venue: Other Restricted Area |
January 12, 2025: Lahore-based stage actress Mahnoor accused a District Police Officer of rape and death threats. In her complaint, Mahnoor alleged that the senior police officer sexually assaulted her at gunpoint, and claimed she was summoned there under the pretext of recovering Rs. 60 million (USD$700,000). According to Mahnoor, the officer’s operator contacted her offering assistance, and instead led her to the DPO’s officer’s house, where he raped her. The actress further alleged that the officer recorded explicit videos of her during the assault and made severe death threats. She expressed fears of blackmail and has contacted the Canadian embassy seeking justice, as a dual citizen.
| Location: Los Angeles, CA | Tactic: Other Crime | Venue: Home |
January 15, 2025: Burglars targeted rapper Kid Cudi’s (Scott Ramon Seguro Mescudi) Calabasas home. An intruder broke in, ate food, used the bathroom, and showered. Around 5 PM, Cudi’s security system captured the suspect, leading police to respond and make an arrest. Mr. Mescudi, who was not home, confirmed no valuables were stolen.
| Location: Mumbai, India | Tactic: Attack | Venue: Home |
January 16, 2025: Police believe a Bangladeshi citizen attacked Bollywood star Saif Ali Khan, shocking the nation’s film industry and Mumbai residents. During a burglary attempt at his home, the intruder stabbed Khan six times. Evidence suggests the suspect is a Bangladeshi citizen and changed his name after entering India illegally. Khan sustained stab wounds to his spine, neck, and hands.
| Location: Cheshire, UK | Tactic: Stalking | Venue: Home |
January 20, 2025: Police arrested a woman from Cheshire on suspicion of stalking reality TV star Joey Essex and threatening the reality TV star’s girlfriend with violence. Authorities have arrested the woman from the Stockport area on suspicion of stalking after the star received over 100,000 messages. The woman has been released on condition of bail and is not permitted to contact Mr. Essex and his family. The messages reportedly grew increasingly frightening with targeted, physical threats which were a cause of concern. Essex is best known for appearing in TV programs including The Only Way Is Essex and most recently the eleventh series of Love Island.
| Location: Los Angeles, CA | Tactic: Other Crime | Venue: Home |
January 21, 2025: Burglars targeted TV personalities Mary and Romain Bonnet’s L.A. residence in the Toluca Lake neighborhood. Law enforcement confirmed that the Bonnets were not home during the burglary, during which intruders entered through an unlocked door. Security camera footage captured the suspects, who fled with approximately $130,000 in jewelry and handbags.
| Location: Los Angeles, CA | Tactic: Harassment | Venue: Home |
January 22, 2025: Actor Ewan McGregor secured a temporary restraining order against a woman who allegedly harassed him and his family with over 500 “rambling, delusional, and threatening” messages. The harassment began in 2022 and escalated when the woman drove from Minnesota to California and tried to access the property of McGregor’s ex-wife on Christmas Eve. The security team turned her away while McGregor and his family were inside. Court documents reveal she issued disturbing threats involving a sniper rifle and the show Dexter and expressed a desire to have children with McGregor.
Federal Government
| Location: Las Vegas, NV | Tactic: Attack | Venue: Public Area |
January 1, 2025: A driver detonated an improvised explosive inside a Tesla Cybertruck outside of the Trump International Hotel in Las Vegas, injuring seven people. Local law enforcement identified the driver as an active-duty U.S. Army Green Beret, an elite fighting force specializing in guerrilla warfare and unconventional tactics abroad.
| Location: Kaduna, Nigeria | Tactic: Attack | Venue: Public Area |
January 1, 2025: Lawal Adamu Usman, the senator representing Kaduna Central Senatorial District, has reportedly survived an alleged assassination attempt. Usman, a member of the People’s Democratic Party (PDP) and a prominent opposition member, confirmed the incident via his Facebook account. The Senator did not provide detailed information about the circumstances surrounding the alleged attack.
| Location: Wuppertal, Nordrhein-Westfallen, Germany | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 3, 2025: A member of the governing Social Democratic Party reported received a letter from “NSU 3.0,” along with an unidentified white powder. “NSU” likely refers to the “National Socialist Underground,” a neo-Nazi movement within Germany. The target, Helge Linde, has served as a member of the Bundestag since 2017, representing the Wuppertal district. Lindh pledged to continue to fight against hatred, extremism, and violence of right-wing groups in Germany. The letter arrived shortly after Germany announced elections for February. The right-wing Alternative fur Deutschland (AfD) party is expected to make significant gains.
| Location: Albuquerque, NM | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 3, 2025: Police arrested an Albuquerque man for allegedly threatening President Donald Trump, Elon Musk and others on social media. The threatening posts included references to Trump’s rally before his Inauguration. U.S. Secret Service questioned the suspect, and he admitted to buying a firearm.
| Location: Brussels, Belgium | Tactic: Stalking | Venue: Office |
January 6, 2025: Belgian police arrested a man armed with a knife outside the Belgian prime minister’s office in Brussels. Local police confirmed the arrest, saying that the man had threatened military personnel stationed at the site, but according to local media, they have not yet determined the man’s motives.
| Location: Caracas, Venezuela | Tactic: Other Crime | Venue: Public Area |
January 7, 2025: Self-exiled Venezuelan opposition leader Edmundo González, who claims to have defeated President Nicolás Maduro in last year’s presidential election, said his son-in-law was kidnapped in Venezuela’s capital. González, who was traveling in the United States, said Rafael Tudares was kidnapped on his way to drop off González’s two grandchildren at school in Caracas. González, a retired diplomat, represented Venezuela’s Unitary Platform opposition coalition in the presidential election, which he and Maduro both claim to have won. The kidnapping occurred as González decided to return to Venezuela to reclaim the presidency from Maduro.
| Location: Bangkok, Thailand | Tactic: Attack | Venue: Public Area |
January 7, 2025: An unidentified gunman shot a former Cambodian opposition MP on a motorcycle in Bangkok. Lim Kimya, a Cambodian-French national, died at the scene. The director of Asia Human Rights Labor Advocates claims that the shooting has the traits of a political assassination. Lim Kimya was elected as an opposition member of Cambodia’s parliament following a general poll in which the ruling party under former leader Hun Sen almost lost to its then-rival, the Cambodia National Rescue Party (CNRP). A court order later dissolved the CNRP, once considered the sole viable opponent to the ruling Cambodian People’s Party (CPP), and banned opposition politicians from political activities.
| Location: Washington, D.C. | Tactic: Stalking | Venue: Other Restricted Area |
January 8, 2025: U.S. Capitol Police arrested a man for attempting to bring a machete and three knives into the U.S. Capitol Visitor Center. The arrest caused a minor disruption for incoming visitors. The perpetrator’s motives are not currently known, but it is notable that this incident occurred during the funeral events for President Jimmy Carter.
| Location: Washington, D.C. | Tactic: Attack | Venue: Public Area |
January 8, 2025: U.S. Capitol Police officers responded to a vehicle parked on First Street, NW. A man had lit a bag on fire on top of the vehicle. The burning bag was extinguished on its own and officers arrested the suspect, who is from Virginia. Investigators found accelerants in the bag that had been ignited, and the car had been spray-painted. Officials do not believe that the incident was linked to the earlier incident in which a man tried to bring a machete into President Carter’s public viewing area.
| Location: Brentwood, CA | Tactic: Stalking | Venue: Home |
January 11, 2025: Police detained two people at Vice President Kamala Harris’ home in Brentwood, California. The two people were in violation of a curfew put in place due to an extreme local fire risk. Police did not immediately release additional information. Local law enforcement reminded residents of the curfew, patrolling areas, and arresting anyone for trespassing and looting. Brentwood had been an area of concern as the Palisades Fire moved into Los Angeles.
| Location: Tehran, Iran | Tactic: Attack | Venue: Public Area |
January 18, 2025: Iran’s judiciary reported that two senior Iranian Supreme Court judges involved in handling espionage and terrorism cases were shot dead in the capital, Tehran. The judiciary said that the attacker killed himself after opening fire on the judges inside the Supreme Court and wounded a bodyguard. The judges killed included mid-ranking Shi’ite Muslim clerics Mohammad Moghiseh and Ali Razini. While the motive for the assassination was still unclear, a judiciary spokesperson told state television that the two judges had been involved in national security cases, including espionage and terrorism. State TV blamed the attacks on Israel and Iranian opposition supported by the United States.
| Location: Fond Du Lac, WI | Tactic: Attack | Venue: Office |
January 19, 2025: A 19-year-old suspect admitted to setting fire to U.S. Representative Glenn Grothman’s office in Fond du Lac in response to the TikTok ban that went into effect at the end of January 2025. Police reported no injuries, as no one was in the office at the time of the fire. The gasoline fire caused minor property damage to the backdoor of the Congressman’s office. Police arrested the suspect at the scene, charging him with arson, attempted burglary, criminal damage, and making terrorist threats.
| Location: Rome, Italy | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 24, 2025: Senator Marco Dreosto, a member of Matteo Salvini’s Lega party, filed a complaint after he received threatening messages targeting himself and Italian authorities from a Russian hacker group known as NoName057(16), linked to a cyberattack on the Port of T. The group carries out distributed Denial of Service (DDoS) attacks on European financial institutions, government websites, and transportation services. The message threatened Italian infrastructure and Italy’s economy with cyberattacks if the country continued to support Ukraine. Italy’s cybersecurity agency mitigated the damage, and the parliamentarian urged stronger protection of national infrastructure.
| Location: Fort Bend, IN | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 24, 2025: Police arrested an Indiana man for threatening to kill President Trump in a TikTok video, claiming it was time to “go Nazi hunting.” The suspect asked for people to encourage him to violence and stated that he had to defend the Declaration of Independence from a tyrannical government.
| Location: Washington, D.C. | Tactic: Stalking | Venue: Office |
January 27, 2025: Capitol police arrested a Massachusetts man with Molotov cocktails and a knife at the U.S. Treasury. The suspect arrived at the capitol with the intent to kill Treasury Secretary Scott Bessent. He admitted he had originally wanted to kill Defense Secretary Pete Hegseth or House Speaker Mike Johnston. In addition to his original intention of killing Hegseth or Johnston, the suspect told police he considered burning down the Heritage Foundation. The man told police that he “had been thinking about this for a while because of Luigi Mangione,” referencing the suspect charged with murdering United HealthCare CEO Brian Thompson in December 2024.
| Location: Stockholm, Sweden | Tactic: Attack | Venue: Office |
January 28, 2025: Police in Stockholm arrested a Ukrainian citizen living in Sweden after he attempted to ram the gates of the Russian Embassy using a passenger vehicle. A police statement indicated that the suspect was “well known to the embassy and the local police.” Police responded quickly and arrested the 45-year-old man on aggravated trespassing. A search of the vehicle did not yield any threats, and the Russian Embassy said that the incident did not cause any significant damage.
State Government
| Location: Miami, FL | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 6, 2025: A Miami man faces charges after allegedly making an online threat to kill Florida Gov. Ron DeSantis. State authorities charged the suspect with making written or electronic threats to kill or cause bodily injury, a second-degree felony under Florida Law. If convicted, he faces up to 15 years in prison and a fine of up to $10,000.
| Location: Gallatin, TN | Tactic: Harassment | Venue: Communication Channels |
| Location: Stamford, CT | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 23, 2025: State Capitol Police are investigating an expletive-filled voicemail that threatened to decapitate State Senate Majority Leader Bob Duff. The caller criticized the state leader for supporting a bill that would prevent the banning of books in libraries. Duff called the voicemail part of a campaign of “misinformation and hysteria,” claiming that access to knowledge is paramount to democracy, while hatred and intolerance only sow division and ignorance.
Local Government
| Location: Pickering, Ontario, Canada | Tactic: Verbal/Written Threat | Venue: Communication Channels |
November 30, 2024: The Ontario Provincial Police launched an investigation after the city of Pickering complained about controversial Councilor Lisa Robinson for her interactions with far-right figures, which may have broken the law. Pickering Mayor Kevin Ashe filed a complaint on behalf of the city council against Councilor Robinson, alleging criminal harassment resulting from her participation in far-right media. Robinson has repeatedly appeared on podcasts known for racist and Islamophobic views, including podcasts that threatened violence against fellow councilors and called them pedophiles. While the original threats began in November 2024, the investigation did not become public until January 2025.
| Location: Rochester, NY | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 3, 2025: Rochester City Council Member Shaun Palmer received an emailed death threat after the City Council voted to ban camping on public property. The email included additional Council Members who supported the ban: Patrick Keane, Mark Bransford, and Norman Wahl. The email said that the ban criminalizes homelessness and is out of step with Mayor Kim Norton’s designation of Rochester as a “compassionate city,” claiming that council members who supported the ban are “part of an era that must be destroyed.” The email also threatened police officers if they were seen responding to the council member’s home. Investigators were not able to trace the email account.
| Location: Moreno Valley, CA | Tactic: Verbal/Written Threat | Venue: Communication Channels |
January 16, 2025: Police arrested a man for claiming that city council members infiltrated his phone and planning to kill them, saying that he would “start killing officers.” The judge ordered the suspect to be examined for mental health and charged him with threatening public officials. The suspect prepared in advance, searching law enforcement databases.
| Location: Manteca, CA | Tactic: Attack | Venue: Home |
January 23, 2025: A Manteca City Council Member shot his stepson after the 31-year-old man allegedly attacked him. According to police, Council Member David Breitenbucher called 911 to report that his stepson had attacked and threatened to kill him. Police said Breitenbucher shot his stepson and suffered a head injury. Both men were taken to the hospital. The attack occurred at the Council Member’s home.
Community Leader
| Location: Terre Haute, IN | Tactic: Attack | Venue: Home |
January 8, 2025: Prosecutors filed charges against a man accused of shooting at and wounding a local doctor. The suspect allegedly followed Dr. Manish Gera home and fired multiple shots, hitting Dr. Gera’s forearm. However, the doctor fought off the suspect until law enforcement arrived and detained him. The suspect faces charges of attempted murder and burglary resulting in serious bodily injury.