As the wrench attack theory is gaining traction as a possible motive for the Feb. 1 suspected abduction of Nancy Guthrie, experts are warning that criminals are increasingly sweeping the web for signs of wealth that could lead them to new victims.
“The bad guys in these cases and in many types of criminal cases utilize open source information and social media information to find their targets and the targets’ vulnerabilities, the pressure point,” said Lisa J. Miller, a retired detective and law enforcement executive at the Colorado Attorney General’s Office. “News releases from companies describing wealth, social media posts showing off big expenditures, big toys, big homes. Many of us put at least some of our lives out there for everyone to see — and it’s usually the happiest part.”
Although wrench attacks can involve complicated crypto transactions, encrypted chats and conspiracies that may cross international borders, the concept is simple: A “mastermind” plans the attack remotely and hires local muscle to carry out a physical abduction, which involves threats and violence to extract ransom.
There have been 34 documented wrench attack incidents in the first four months of 2026, according to the cybersecurity firm CertiK — a 41% increase over last year.
NANCY GUTHRIE CASE POINTS TO CRIMINAL UNDERWORLD ‘WRENCH ATTACK’ THEORY, RETIRED DETECTIVE SAYS
While Guthrie is the 84-year-old mother of NBC’s Savannah Guthrie, Miller said relatives of the real targets can sometimes be hurt in wrench attacks because they are more accessible than the public figures themselves.
“Nancy Guthrie could have been viewed by someone watching [her ‘Today’] segment as a vulnerability, Savannah Guthrie’s pressure point,” Miller said.
As a result, everyone could benefit from minimizing the amount of personal information about them online.
“Protecting ourselves requires the usual things we have all been told about before — restrict your social media profiles, never post photos of your home, know who the audience is when you post pictures of your children, family, visible signs of financial security,” Miller said. “Monitor your online presence when it comes to what data is available about you online.”
There are paid services that specialize in locking down your personal information as it appears online, she added, and some tech firms, such as Google, will help for free.
“It’s all easier said than done because we live in an ever-increasing digital world, where more people know and have the skills to mine open source information to get data about you,” Miller said. “And who hasn’t shared the pictures of the best and prettiest dogs in the world with people they love, or pics of their grandchildren?”
FOLLOW THE FOX TRUE CRIME TEAM ON X
Not everyone who sees those posts is friendly — or even safe, she told Fox News Digital.
“Safety in this digital world is very similar to advice I give women about their personal safety,” she said. “Be aware.”
While the vast majority of documented wrench attacks have occurred in France, the United States is a distant second.
SIGN UP TO GET TRUE CRIME NEWSLETTER
CertiK identified Guthrie’s case as an example of “proxy target selection,” meaning someone else could have been physically taken because they were more vulnerable than a wealthy relative. The report noted an early $6 million cryptocurrency ransom demand.
“In more than half of those cases, the real target wasn’t the person taken,” Miller explained, citing CertiK’s report on wrench attacks in the first four months of 2026.
However, law enforcement has not publicly identified Guthrie’s disappearance as connected to a wrench attack.
“The Pima County Sheriff’s Department has not received any reports reference ‘wrench attacks’ in our community,” a spokesperson told Fox News Digital back in May. “The investigation into Nancy Guthrie’s disappearance remains active and ongoing. When there is a significant update, it will be shared publicly.”
LISTEN TO THE NEW ‘CRIME & JUSTICE WITH DONNA ROTUNNO’ PODCAST
Pima County Sheriff Chris Nanos told Fox News Digital Monday that he’d flagged the CertiK report to investigators on the Guthrie case.
Savannah Guthrie had often spoken of her Tucson roots, and “Today” ran segments highlighting her mother and favorite hometown haunts. But other wrench attack victims have had much lower profiles — yet still showed public displays of wealth that may have led attackers to them, Miller said.
LIKE WHAT YOU’RE READING? FIND MORE ON THE TRUE CRIME HUB
“If Savannah was in fact the target as I and others suspect…someone studied her for a period of time,” Miller said. “That study very likely could have been to find her pressure point because she has security in her New York life and world.”
While authorities have not confirmed whether they are looking into the Guthrie case as a potential wrench attack, the masked man who appeared on her Nest doorbell camera could be the hired muscle, Miller said, with someone more sophisticated pulling the strings and the initial attempts to collect ransom.
Another image from her doorbell camera, taken overnight about three weeks earlier, showed a similar masked figure — a sign that he did scout her home in advance.
“Predators target others for a variety of reasons, and it is not the fault of the victim they were targeted by a monster who brought evil to their doorstep,” Miller said.
