The theory of a “wrench attack” is emerging as a potential motive in the suspected abduction of Nancy Guthrie on February 1st. Experts caution that criminals are increasingly scouring the internet for indicators of wealth, which could help them identify future victims.
Lisa J. Miller, a former detective and law enforcement executive with the Colorado Attorney General’s Office, explains, “Criminals often use open-source data and social media to pinpoint their targets and identify vulnerabilities. News releases about wealth, social media posts flaunting lavish spending, luxury items, and large homes all serve as potential leads. Many people share parts of their lives online, often highlighting their happiest moments.”
While wrench attacks can involve complex crypto transactions and encrypted communications, including conspiracies that may stretch across borders, the basic premise is straightforward: a “mastermind” orchestrates the attack from afar, hiring local individuals to execute an abduction involving threats and violence to demand a ransom.
According to the cybersecurity firm Certik, there have been 34 documented wrench attack incidents in the first four months of 2026, marking a 41% increase from the previous year.
Savannah Guthrie has returned to her role on “Today” after a two-month hiatus, following the disappearance of her mother, Nancy Guthrie, from their Arizona residence amidst an ongoing kidnapping investigation. (Getty Images/News Media)
While Guthrie is the 84-year-old mother of NBC’s Savannah Guthrie, Miller said relatives of the real targets can sometimes be hurt in wrench attacks because they are more accessible than the public figures themselves.
“Nancy Guthrie could have been viewed by someone watching [her ‘Today’] segment as a vulnerability, Savannah Guthrie’s pressure point,” Miller said.
As a result, everyone could benefit from minimizing the amount of personal information about them online.
Pima County deputies examine a flyer taped to the mailbox outside Nancy Guthrie’s home in Tucson, Ariz., on Feb. 23, 2026. Guthrie, the 84-year-old mother of “Today” co-host Savannah Guthrie, is believed to have been abducted from her home in the early hours of Feb. 1. (Michael Ruiz/News Media)
“Protecting ourselves requires the usual things we have all been told about before — restrict your social media profiles, never post photos of your home, know who the audience is when you post pictures of your children, family, visible signs of financial security,” Miller said. “Monitor your online presence when it comes to what data is available about you online.”
There are paid services that specialize in locking down your personal information as it appears online, she added, and some tech firms, such as Google, will help for free.
“It’s all easier said than done because we live in an ever-increasing digital world, where more people know and have the skills to mine open source information to get data about you,” Miller said. “And who hasn’t shared the pictures of the best and prettiest dogs in the world with people they love, or pics of their grandchildren?”
WATCH: Nancy Guthrie’s Nest doorbell cam records masked suspect
Not everyone who sees those posts is friendly — or even safe, she told News Media.
“Safety in this digital world is very similar to advice I give women about their personal safety,” she said. “Be aware.”
While the vast majority of documented wrench attacks have occurred in France, the United States is a distant second.
Certik identified Guthrie’s case as an example of “proxy target selection,” meaning someone else could have been physically taken because they were more vulnerable than a wealthy relative. The report noted an early $6 million cryptocurrency ransom demand.
A well-wisher signs a banner with a photo of Nancy Guthrie and the words “Bring her home” outside the KVOA newsroom in Tucson, Ariz., on Feb. 12, 2026. Nancy Guthrie, the 84-year-old mother of journalist Savannah Guthrie, is missing from her Tucson home. (Rebecca Noble/Reuters)
“In more than half of those cases, the real target wasn’t the person taken,” Miller explained, citing Certik’s report on wrench attacks in the first four months of 2026.
However, law enforcement has not publicly identified Guthrie’s disappearance as connected to a wrench attack.
A well-wisher places flowers outside the home of Nancy Guthrie in the Catalina Foothills of Tucson, Arizona, after her disappearance was reported on Feb. 11, 2026. (Rebecca Noble/Reuters)
“The Pima County Sheriff’s Department has not received any reports reference ‘wrench attacks’ in our community,” a spokesperson told News Media back in May. “The investigation into Nancy Guthrie’s disappearance remains active and ongoing. When there is a significant update, it will be shared publicly.”
Pima County Sheriff Chris Nanos told News Media Monday that he’d flagged the Certik report to investigators on the Guthrie case.
Savannah Guthrie had often spoken of her Tucson roots, and “Today” ran segments highlighting her mother and favorite hometown haunts. But other wrench attack victims have had much lower profiles — yet still showed public displays of wealth that may have led attackers to them, Miller said.
Pima County Sheriff Chris Nanos speaks to the media in Tucson, Ariz., on Feb. 3, 2026, about the search for Nancy Guthrie, the missing mother of NBC host Savannah Guthrie. (Jan Sonnenmair/Getty Images)
“If Savannah was in fact the target as I and others suspect…someone studied her for a period of time,” Miller said. “That study very likely could have been to find her pressure point because she has security in her New York life and world.”
While authorities have not confirmed whether they are looking into the Guthrie case as a potential wrench attack, the masked man who appeared on her Nest doorbell camera could be the hired muscle, Miller said, with someone more sophisticated pulling the strings and the initial attempts to collect ransom.
Another image from her doorbell camera, taken overnight about three weeks earlier, showed a similar masked figure — a sign that he did scout her home in advance.
“Predators target others for a variety of reasons, and it is not the fault of the victim they were targeted by a monster who brought evil to their doorstep,” Miller said.
