Global | Potential for further attacks on business leaders

• On 4 December an individual with grievances against corporations and health insurers shot and killed the CEO of UnitedHealthcare in New York City
• While left- and right-wing groups have praised the murder, almost all anti-corporate activists seem intent on non-violent forms of protest, such as staging demonstrations or verbally confronting executives

Clients have asked us about the potential for further attacks on business leaders after an individual killed the CEO of UnitedHealthcare in New York City on 4 December. Police have arrested and charged a suspect since. Based on the man’s social media posts, a note he wrote and details about him from US press outlets, the apparent perpetrator was aggrieved with health insurance companies, which he perceived as greedy. We have not seen any information to suggest he was part of a group. Given this, we strongly doubt that further similar attacks are imminent.

Attacks on business leaders will probably remain extremely rare in the US and globally in the coming years. Some users on extremist channels have praised the attack, expressed hostility towards health insurers and major corporations, and encouraged attacks on corporate executives. But, in our assessment, this sentiment will primarily be expressed through non-violent action, such as protests and verbal confrontations. Activists will particularly focus on the healthcare, pharmaceutical, extractives, defence and banking industries in the US and Europe, based on their rhetoric and worldviews.

Highly unusual assassination last week

On 4 December an individual shot Brian Thompson, the CEO of UnitedHealthcare, outside a hotel in Midtown, New York City. Since then, the New York City Police Department (NYPD) and US press outlets have released details about the shooting, including that the perpetrator had written what press outlets have described as an anti-healthcare insurer slogan on the bullet casings. Earlier this week, the NYPD said that Luigi Mangione had been arrested in Pennsylvania and charged with the murder. The police have said that Mangione is their main suspect and he said he acted alone.

Mangione does not appear to have been aligned with any ideological groups. This is based on our analysis of his social media pages, statements from people who knew Mangione cited by US news outlets, and a note found on him, which the police have described as a manifesto. Mangione expressed anti-corporate sentiment. And an internal NYPD report cited by The New York Times on 10 December said that Mangione saw the killing as a ‘symbolic takedown’ of the industry, which he saw as exploitative.

Praise for the assassination online

There has been significant praise online for Mangione’s actions that points to widespread hostility towards corporate interests and leaders. This is from users on mainstream social media platforms and on left-wing and right-wing extremist forums. According to the police report cited by The New York Times, police officials have said there is a ‘risk that a wide range of extremists may view Mangione as a martyr and an example to follow’.

We have seen some users on extremist forums encouraging attacks on corporate executives since Thompson’s murder. For example, a list of health insurance company CEOs (including their photos) has been shared on Reddit in recent days. We have also seen a ‘hitlist’ of potential targets who represent a range of sectors on a right-wing extremist channel. And Mangione’s sympathisers have put up ‘wanted’ posters featuring healthcare executives on streets in Manhattan.

Most anti-corporate actions likely to be non-violent

We doubt this rhetoric means attacks against business leaders are significantly more likely than they were before Thompson’s murder. The attack could plausibly inspire similar actions by lone actors. But we have not seen any evidence that organised groups are planning on mounting attacks, or that doing so is their general intent. And Mangione’s willingness to use violence is highly unusual.

Most anti-corporate activists will almost certainly use non-violent – but still threatening – tactics. This includes staging protests outside corporate offices, verbally confronting executives and swatting them (which involves falsely reporting to the police that a crime is occurring at the target’s house).

The main targets for such actions would probably be executives in the healthcare, pharmaceutical, extractives, defence and banking industries. That is based on our monitoring of extremist forums online and our analysis of their narratives. We have seen left-wing and right-wing groups particularly mention executives in these industries as they perceive them as greedy or corrupt.

For instance, business leaders who are controversial in far-right forums online have been frequently targeted by swatting attempts in recent years. Companies in the healthcare industry have been particularly targeted, seemingly due to their role in producing vaccines.

Clients have asked us about the main locations for any anti-executive actions. In our assessment, these are particularly likely in major cities in the US and Europe, such as London and New York City. This is due to the high concentration of executives and prominent activists. Such cities also seem to be considered safe by corporate executive security teams, making executives potentially vulnerable; Thompson does not seem to have had a security detail with him when he was shot. But generally, activists seem intent on staging direct actions wherever executives or businesses are present.

Individuals or activist groups seeking to target executives seem to primarily use publicly available information. The NYPD has not released details regarding how Mangione located Thompson. But according to press reports, many companies have sought to remove publicly-available information online about their executives following the killing last week. And many companies reportedly use airport-style security facilities at events where executives are speaking, seemingly because they anticipate protests or potentially violent actions against them.

Other wide-ranging threats to executives

There have been other instances of threatening activity towards executives in recent years, seemingly because they are high-profile figures. Elon Musk, a prominent businessman based in the US, claimed in July that two people ‘with guns’ had recently tried to kill him on separate occasions in Texas. He has not provided any further details. And in 2019, Apple filed a restraining order against a man it accused of stalking its executives and trying to enter the home of its CEO in Palo Alto, California. Such cases are likely to remain extremely rare though, in our assessment.

Separately, major international news outlets reported in July that Russia planned to assassinate the CEO of a major German arms manufacturer. According to these outlets, which cited Western officials, this is because the company had been supplying weapons to Ukraine. This is part of a broader campaign of Russian sabotage efforts in Europe, aiming to cause property damage or temporary operational disruption at strategic locations, such as airports. But we doubt that Russia would target Western corporate executives more broadly.

Historically, executives and their family members have been kidnapped by criminals in demand for a ransom. In the most recent case, the CEO of a cryptocurrency firm was briefly kidnapped in central Toronto in November. But in the 1990s an oil company executive was kidnapped by a disgruntled former employee, leading to the death of the executive. While there have been some cases in recent decades in Latin America, such cases will almost certainly remain extremely rare in the US and other Western countries.

Instead, cybercrime targeting executives appears to have become common. In February this year, cybercriminals used AI voice technology mimicking the CEO of a multinational company to convince an employee in the Hong Kong office to transfer nearly $26m. There have been similar cases targeting executives in recent years, or cases of criminals impersonating executives and demanding payment from employees for fake invoices. These have primarily taken place in Europe and the US. Cybercriminals also seem to frequently target executives with spear phishing emails.