Saints, Copycats, and the Continuing Threat to CEOs

Saints, Copycats, and the Continuing Threat to CEOs

By TorchStone VP, Scott Stewart

The targeted assassination of United HealthCare CEO Brian Thompson on December 4, 2024, continues to reverberate through C-suites and corporate boardrooms. While a contagion effect spawning attacks against other executives did not occur in the days and weeks after the murder—we are witnessing a troubling surge of anti-capitalist and anti-corporate sentiment and vitriol that shows no sign of ebbing two months after Mr. Thompson’s death.

In the wake of the murder, anti-capitalist extremists pasted CEO “wanted posters” at various locations in Manhattan, and a Socialist clothing company announced they were publishing a deck of “most wanted CEO” cards akin to those the U.S. military issued in Iraq for wanted terrorists. The four suits of cards in the deck featured executives from different sectors. Clubs focused on chemicals, agriculture, and logistics; diamonds on finance, tech, and the media; hearts on healthcare, real estate, and retail; and finally, spades on weapons, energy, and pharmaceuticals. New York City Police Commissioner Jessica Tisch was the joker.

Once the suspect in the murder of Mr. Thompson had been arrested and identified, he quickly became a celebrity in certain social media circles, with women gushing over the “hot killer,”  and people holding killer look-alike contests in various American cities, and even as far away as Brazil. He quickly became a sort of folk hero who was seen as “sticking it to” corporate America.

While TorchStone normally prefers to avoid using the names of murder suspects, to deny them the attention they typically seek, in this case we believe we must mention his name, Luigi Mangione, because the name has become a verb. To “Luigi” someone means you are going to assassinate them, as reflected in these recent posts on X.

Luigi graffiti has also popped up all over the globe encouraging attacks against CEOs and corporate executives, as seen by this recent example from Athens, Greece.

Like many past white supremacists and Incel murderers, Mangione has even been labeled as a “saint” or someone who other extremists should venerate and copy.

Veneration of Killers

This veneration dovetails into what we refer to as the social media threat continuum, a process by which “extremist influencers” post propaganda on social media platforms containing grievance narratives intended to radicalize adherents and then inspire them to conduct attacks against identified enemies of their extremist ideologies.

Among white supremacist extremists, this type of veneration has resulted in a string of murders by adherents that have spanned the globe from Oslo, Norway, to Auckland, New Zealand, and the United States from El Paso, Texas to Buffalo, NY.

Incel extremists have likewise venerated killers, which has also resulted in copycat attacks. But the killers venerated on social media who have inspired the most copycat plots and attacks were the two men who conducted an attack against their classmates at Columbine High School in April of 1999. Since that attack, communities of “Columbiners” have proliferated on web forums and social media platforms in numerous languages as people fascinated by the Columbine murderers study them—and in many cases seek to emulate them. Copycat attacks by Columbiners have been committed in numerous countries including Sweden, Canada, Germany, and Russia. In some of these cases, the killers have attempted to dress like the Columbine killers, and some attackers have even attempted to acquire the same guns used in the Columbine.

In many of the more recent cases in which the killers cite Columbine as an inspiration, the killers weren’t even born at the time of the 1999 attack—demonstrating the persistence of the copycat phenomenon.

The continuing celebration of the Thompson murder and the veneration of Luigi Mangione raise the very real possibility that there will be copycat attacks. It is also possible that these attacks may involve targets other than CEOs.

On January 27, a Massachusetts resident was arrested at the U.S. Capitol after being found in possession of a folding knife and two Molotov cocktails. The person told the arresting Capitol Police Officers they had traveled to Washington to kill then-Treasury Secretary nominee Scott Bessent, other Trump Administration officials, and to burn down the Heritage Foundation office. They also claimed that they had been inspired to take action by Luigi Mangione’s murder of Brian Thompson.

Bringing the Threat Home

While the January 27 arrest in Washington occurred at the Capitol, and Brian Thompson was murdered in a public space prior to an announced public appearance, there is also a high likelihood of CEOs and other potential targets being attacked at or near their homes. As we noted in our Annual 2024 TorchStone Global Executive Protection Report, the home was the most common place where high-profile individuals were targeted in 2024 and has been the most common attack site since we began keeping track of such incidents.

This is not surprising since the home is a “known location”, and most people spend more time at home than any other place. Residences also tend to have less security in terms of both access control measures and personnel than office buildings. Activists also know executives feel more pressure when they are harassed at home, or when a protest is conducted outside their home instead of at the office.

This reality emphasizes the importance of protecting personal information, such as the address of the residence. We advise clients to purchase their homes using a non-descript LLC or Trust instead of in their own name and to use their office address or the address of a family business office or lawyer whenever possible to help keep their address information private. Using an LLC name and credit card for online purchases can also help protect address information from being picked up by data aggregators. Engaging an information removal company such as 360 Privacy to help take down or obfuscate personally identifying information (PII) appearing on the internet can also help keep bad actors from obtaining address information.

The targeting of executives and other prominent individuals at their homes also illustrates the importance of having a solid residential security program, and we continue to encourage CEOs and other prominent individuals to review their residential security to ensure it is sufficient. In addition to having adequate security equipment and procedures, security devices and systems must be used. Locks and alarms are of no use if they are not engaged.

Denouncing and Doxing

As noted above, the veneration of killers like Luigi Mangione ties into the social media threat continuum in which extremist influencers attempt to radicalize adherents and then inspire them to conduct attacks.

Because of this, it will be important for security teams to watch for indications that their principals have been denounced as enemies who are to be targeted. While the executives who appeared on the wanted posters and the deck of cards mentioned above are certainly on notice—as are their security teams—they are by no means the only ones who could possibly be targeted by anti-capitalist and anti-corporate extremists. At TorchStone, we have added “Luigi,” “Luigied,” “Mangione” and “Mangioned” to the list of threat terms we use when scanning social media streams for threats against our clients.

When an executive is denounced, it is not unusual for them to then be “doxed,” which means to have their personal information, often including their home address, listed in social media threads, internet forums, or dark web doxbins. Using scanning tools to search for addresses, telephone numbers, and other PII can help provide a timely warning of a dox.

Due to the prevalence of swatting as a harassment technique, we recommend that contact be made with the local police dispatch center to inform them of the potential for a swatting at an executive’s home, and this is especially important if the executive has been denounced and doxed.

Since all attackers are bound by the constraints of the attack cycle, once an executive has been denounced and doxed, it might also be prudent to consider establishing a surveillance detection program to attempt to pick up on any signs of preoperational surveillance or other signs of the attack planning cycle.

Lone attackers operating under the rubric of leaderless resistance do have some operational security advantages, but at the same time, they normally lack sophisticated tradecraft and are typically not difficult to detect as they progress through their attack cycle—but only if someone is looking for them.

Mangione’s next scheduled court appearance in Manhattan is on Feb 21. Subsequent legal developments are sure to re-elevate publicity around the case and, by extension, increase anti-CEO/anti-capitalist rhetoric.

The last time Mangione appeared in court on Dec 23, dozens of protesters gathered outside the courthouse with signs supportive of the accused killer and critical of corporations and government authorities. That support continues, as evidenced by the nearly $300,000 raised for Mangione’s legal fees in the past two months. Legal proceedings tend to inspire actions in support of the charged individual, like Mangione and can lead to protest actions, acts of sabotage, or even attacks. Because of this, it will be important to track the progress of Mangione’s trial and adjust security accordingly.