Workplace Violence Attack at Sebring, Florida Bank: Key Takeaways for Business Leaders

Workplace Violence Attack at Sebring, Florida Bank: Key Takeaways for Business Leaders
February 14, 2019 SDC Development 2

Workplace Violence Attack at Sebring, Florida Bank: Key Takeaways for Business Leaders

By Dr. Joshua Sinai, TorchStone Global Consultant

This article is an assessment for business leaders of the ramifications of a significant recent multiple-casualty shooting incident at a Florida bank branch to enable company executives and their employees to effectively anticipate, prepare for, respond against, and recover from such incidents as resiliently as possible. Among several findings discussed in the article are that such incidents, while statistically unlikely, can occur “by anyone, to anyone, anytime, and everywhere,” and they can have a massive human, financial, and reputational impact on a business, its employees, and customers.

In the incident, which occurred on January 23, 2019 at a Suntrust Bank branch in Sebring, FL, a 21-year old gunman stormed into the bank, forced four female employees, and an additional female customer who was already inside the branch, to lay down on the floor and then executed all of them with a 9mm handgun. A sixth potential victim, also a bank employee, had managed to hide when the attack commenced and ran out of the facility to contact 911 for law enforcement response.

For the bank’s employees, this attack was a workplace violence “Type 1 – Criminal,” as the shooter appeared to have no direct connection to the bank, for instance, as a customer. It was also what is termed an active shooter incident, in which a shooter targets victims in a random manner while trying to inflict as many casualties as possible in the shortest amount of time until law enforcement arrives. This attack also transitioned into an extended hostage barricade incident until a police SWAT team arrived to neutralize the shooter, who gave himself up for arrest.

To provide situational awareness of the ramifications to businesses of such attacks, this article assesses the types of violence involved in this attack, the attacker’s pathway into violence, including intervention points that apparently were missed by those associated with the perpetrator that could have preempted him during the pre-incident phases, and the security measures that such businesses need to implement in order to prepare to prevent and mitigate their impacts. These preparations include ensuring that due diligence is exercised in terms of emergency response planning and exercises and compliance with government and industry regulations as well as standards in ensuring a safe workplace for employees and customers. Finally, the legal and financial liability issues that arise from such violent attacks at businesses, where employees and customers are victimized, need to be considered, since the impacts of violent attacks continue to affect victims, their families, other employees, and customers, including a business’s reputation and competitive advantage, in the weeks, months, and sometimes years to follow.

The Incident

On Wednesday, January 23, 2019, beginning around 12:30 pm, Zephen Xaver, aged 21, burst into the lobby of a SunTrust bank branch in Sebring, Florida, and immediately killed four female bank employees and an additional female customer who was also inside the facility. At 12:36 pm, Xaver called 911 and told dispatchers he was inside the bank, armed with a 9mm handgun and wearing a bulletproof vest, and had just shot five people. The 911 dispatchers continued to maintain phone contact with Xaver, and at 12:38 pm, officers from the Sebring Police Department and the Highlands Sheriff’s Office arrived at the scene. After finding the bank’s doors locked, the police called in the SWAT team.

Xaver’s attack then transitioned into a hostage barricade situation, as he appeared to have no intention in giving in to police negotiators to let the responding officers and emergency medical system (EMS) personnel gain access to the victims. This prompted authorities to make a tactical entry into the bank at 1:54 pm, when the SWAT Team’s officers succeeded in entering the bank using an armored vehicle to break through the entrance, where they found Xaver in a rear office. According to the arrest report, Xaver was taken into custody without further incident at 2:28 pm.

In the attack’s aftermath, Xaver was charged with five counts of premeditated murder in the shooting. It was reported that the State Attorney would seek the death penalty for his sentence.

Pathway into Violence

Many active shooters appear to be driven by some type of psychological disorder to engage in targeted violence against their perceived adversaries, since ‘normal’ individuals are likely to find constructive and non-violent ways to redress their various grievances. Such attacks also represent the culmination of a trajectory process into violence of various timeframe lengths. As explained by the psychological literature, there are two possible responses to triggering events that drive such individuals into engaging in violence: reactive or predatory. In a reactive response, which is also referred to as “in the heat of the moment,” the decision to launch an attack is relatively quick, usually immediately in the aftermath of a perceived grievance. Predatory or targeted violence could still take place within a day or two in response to a perceived grievance, but generally involves a lengthier degree of preparation and planning that for some perpetrators could last days, weeks, or even a year or two, with such individuals usually appearing ‘calm’ and ‘silently determined’, in order not to let others aware of their violent intentions.

As part of the pathway into violence, such psychological drivers then turn such susceptible individuals into ideational fantasies of taking violent revenge against their perceived adversaries, but unlike other individuals who might stop at such a phase, they proceed to cross a threshold into violence by bypassing any internal or external constraints that might stop them in seeing their fantasy through its violent endpoint.

It is important for company managers to map a susceptible individual’s potential trajectory into violence because this can also point to early warning signs that might be observable by those who come into contact with them that could lead to opportunities for early pre-incident intervention, for example, via mental health counselors or law enforcement.

With this analytic framework applied to Xaver’s possible pathway into violence – although it is too soon to authoritatively map his trajectory into carrying out his attack (since it is still under investigation), specifically on January 23, 2019, against a bank branch where he may not have been a customer and may not have known anyone associated with that bank, published news reports do point to several early warning signs that might have suggested a potential for violence.

What is known about 21-year-old Xaver is that he had a highly troubled personal life in which he had long expressed a desire to commit violence. A 2014 report by the Bremen Police Department, in Indiana, where he lived with his family, reported that Xaver, then 16, stated that “he had dreams of hurting other students in a classroom.” The report was produced in response to contact by the Bremen High School Principal. Xaver’s mother agreed to refer him to a behavioral health center, but no further action was taken by the police. In another incident, in March 2017, Michigan State Police was informed that Xaver had sent messages to a girl that he was “possibly thinking of suicide by cop and taking hostages.” Again, for various reasons that are not publicly known, no firm action was taken by the police against Xaver. In another possible intervention point, Xaver’s former girlfriend in Indiana had reported that he was “fascinated with the idea of killing, but no one took her warnings about him seriously.” The identity of those she had reported these concerns to at the time is not publicly known, other than she had expressed her concerns about Xaver to the WSBT-TV news station near his former home in Plymouth, Indiana, following his attack.

Another possible early warning indicator of a susceptible individual’s potential trajectory into violence can be provided by their employment history. In this case, it was reported that he had a brief experience as a trainee prison guard at the Avon Park Correctional Institution, in Avon Park, Florida, which began on November 2, 2018 (he had moved with his mother from Plymouth, Indiana to Florida in April 2018). His employment ended with his resignation on January 9, 2019. Although no disciplinary issues were reported as a factor in his resignation, it is possible (although this has not been publicly verified) that it may have served as one of the triggers that propelled him further down the pathway to carry out his violent attack some two weeks later.

It is reported that Xaver had purchased a weapon a week prior to the attack, furthering him down the pathway to violence. As another possible intervention point that was missed, his former girlfriend had reported that his gun purchase was known, but “no one thought anything of it” because of his affinity for firearms.” As a potential intervention point, Xaver’s “affinity for firearms” should have been flagged in the system earlier on, especially when it became known that he had made statements about his desire to violently harm others.

Key Takeaways for Businesses

The SunTrust Bank branch’s incident is already generating several preliminary findings – with numerous others likely to be produced once the attack’s investigation is completed. Some of the preliminary findings, which are organized topically, include the following: threat assessment, preempting the pathway to violence, security, continuity of business operations, and insurance liability.

Threat Assessment

First, in anticipating potential threats that might target a company, it is important to consider them as multi-dimensional in nature, including the possibility that one type of attack, such as an active shooting or a criminal robbery, might transition into a secondary type of attack such as an extended hostage barricade situation. This was the case with the SunTrust Bank event, with the shooter’s initial killing spree, which lasted a few minutes, turning into a 74-minute hostage barricade. The changing nature of the attack also affected the timeframe of the law enforcement response in neutralizing the attacker, which was complicated by the lengthy hostage barricade situation.

To aid businesses in anticipating potential violent threats, therefore, it is important to conduct risk assessments on a regular basis, with overall risk based on the nature of potential threat(s), the assessed vulnerability to various types of attacks, and the consequences to a business of such attacks. To assess potential threats, some form of protective intelligence reporting should be established to monitor for potential threats against a business, including its overall business sector (e.g., threats against a banking sector), in order to identify trends for security risks that might challenge such sectors and the types of businesses within them.

Preempting the Pathway to Violence

Second, like numerous past attacks, the perpetrator’s trajectory into violence was evident to some who knew him, yet perhaps more could have been done to take the appropriate measures that are necessary to preempt such a potential violent attacker, including ensuring that he did not have access to firearms, or, at the very least, that this was closely monitored and controlled.

Training in identifying potential risk factors by susceptible individuals who may be along a trajectory into potential violence that might threaten a company, and understanding how to preempt them as early as possible at critical intervention points, is crucial. This can be done by establishing some form of a threat assessment team (TAM) within a company, with the makeup of such a TAM dependent on a company’s size, location(s), and other factors.


Third, business leaders need to evaluate their company’s risk environment and ensure that a comprehensive risk mitigation plan is in place. When evaluating the consequences of an incident such as a multiple-casualty shooting at a bank branch, and relating it to their own organization, security-related questions might include the following:

    • What was the nature of the security presence at the time of the incident? Moreover, did the local crime rate necessitate a security presence at the bank? If a security officer had been present, was he/she armed or not? Would an armed security officer have affected the attack’s outcome, for instance, by serving as a deterrent to harden the facility?
    • At the time of the attack what other security systems were in place at the branch, such as video surveillance, mass notification alerts, access control lockdowns, etc.?
    • What was the nature of workplace violence prevention training provided to the bank’s staff? Thus, were they trained to prepare to respond to the four types of workplace violence incidents that might threaten their workforce? In this case, the first type of workplace violence, Type 1: Criminal, applied to the attack, as Xaver, while not a criminal robber (who would attack a bank for illicit profit purposes), had no direct link to that particular bank branch (especially as a customer). Managers and their employees, nevertheless, still need to prepare for a potential incident that might involve a shooting rampage, whether it is presented by a Type 1 attacker (criminal), Type 2 attacker (customer/patient), Type 3 attacker (worker-on-worker), or Type 4 attacker (personal relationship).
    • Fourth, the fact that a potential fifth bank employee victim had succeeded in hiding and then running out of the facility to escape the shooting rampage and then contact 911, demonstrates the critical importance of having a dynamic response protocol already in-place and that employees are confident in their ability to follow the protocol.
Continuity of Business Operations

Fifth, the aftermath of multiple-casualty attacks is traumatizing psychologically, financially, and in other ways to the victims, their families, and survivors, as well. Prior to the occurrence of violent events, managers should consider the spectrum of measures involved in effectively mitigating such potential traumas in the course of establishing their business continuity plans. A business might decide to activate an employee assistance program to support affected employees in the immediate and longer term periods following such incidents.

This was the case in the immediate aftermath of the attack against the SunTrust bank when the bank’s headquarters established a fund to offer financial support to the five victims’ families. Called the “Sebring Strong Survivors Fund,” it included a partnership between the SunTrust Foundation and the National Compassion Fund, a subsidiary of the National Center for Victims of Crime.

Sixth, it is important for businesses to hold regular meetings ahead of time to discuss additional aspects of continuity of operations, such as how to prepare to recover from any category of sudden natural or man-made disruptions to their business and how expensive it might be to their financial stability.

In this case, as can be expected in the aftermath of such a multiple-casualty attacks, the bank had decided not to reopen the branch and to use the facility for another use. This was also the case with other multiple-casualty attacks, such as the Sandy Hook Elementary School (December 14, 2012), which was razed, and the Pulse Nightclub (June 12, 2016), which was turned into a memorial for the victims and survivors.

Insurance Liability

Finally, it appears that the emerging market in insuring companies in the event of violent incidents against their employees, customers, and others, protecting against workplace violence (including active shooting) incidents is assuming a major role in the insurance risk premium marketplace. To be fully compliant with government regulations, companies must demonstrate their compliance with regulations such as OSHA’s General Duty Clause, which calls on companies to ensure their workplaces are safe and secure. Insurance policies that cover such violent incidents against a workplace reportedly cover post-attack issues such as the deployment of crisis/trauma response teams, victim counseling, funeral expenses, as well as property damages, monetary awards and settlements. Such insurance policies might also include security audits and vulnerability assessments. Demonstrating such due diligence is especially critical, with victims and their families seeking multi-million dollar settlements, such as the $58 million being sought by one of the victim’s family affected by the December 5, 2015 shooting rampage at the San Bernardino Inland Regional Center.


The shooting rampage at the SunTrust Bank’s branch in Sebring, FL, was not an isolated incident, but part of a pervasive violent threat phenomenon that affects a spectrum of companies and organizations, whether large or small, and that can occur “by anyone, to anyone, anytime, and everywhere” around the country. It also represented a more complex type of threat, as the attacker’s initial shooting rampage, which lasted only a few minutes, transitioned into a lengthier hostage barricade situation, which vastly complicated the law enforcement responders’ ability to neutralize the attacker and restore a safe environment in the facility. The conventional assumption that “it can’t happen here to our company” is no longer deemed acceptable, with numerous highly specialized consulting and training firms in a position to assist such companies to upgrade their security posture to ensure a high degree of compliance and due diligence that will make it possible for them to anticipate, prepare for, respond effectively, and recover from such incidents in a resilient manner.


To learn more about our workplace violence workshops or TorchStone’s consultation and security services, please contact us.