On July 28, 2025, Shane Devon Tamura, a 27-year-old with known mental health issues, entered 345 Park Avenue, New York City, and opened fire, killing four people before taking his own life. A suicide note indicated his motive was a grievance with the National Football League (NFL) over chronic traumatic encephalopathy (CTE).
In our work to safeguard companies and their people, Resolver is seeing a concerning pattern emerging that generates a cycle of violent sentiment in the aftermath of anti-corporate violence. Following the tragic events of the Midtown shooting, online risks observed in the case of the assassination of UnitedHealthcare CEO Brian Thompson such as the sudden surge in viral content celebrating or tacitly justifying violence — were mirrored, with significant implications for executive protection.
Investigators believe the NFL, which has headquarters in the building, was his intended target, but he went to the wrong floor. Tamura’s actions demonstrate how a grievance directed at a corporation can manifest as a violent, physical attack on its perceived personnel.
Despite the assailant’s failed attempt at targeting the NFL office, multiple individuals were murdered, including Wesley LePatner, CEO of Blackstone Real Estate Investment Trust (BREIT). The trust is wholly owned by Blackstone, the largest owner of commercial real estate globally and the subject of numerous conspiracy theories and significant hostility.
Companies seeking to protect their executives and assets are faced with a double dilemma in an increasingly volatile and uncertain corporate security landscape that is coming to define the past year. Not only must they put in place more robust target hardening strategies to protect their people and the places they work, but also manage the aftermath of tragic violent events, both targeted and seemingly random.
The Brian Thompson precedent
The aftermath of the violent incident involving UnitedHealthcare CEO Brian Thompson shows how the act of anti-corporate violence can inspire a popular movement emerging from mistrust in corporate intentions and amplified through online engagement.
The primary suspect, Luigi Mangione, was immediately glorified across social media platforms as a folk hero who confronted corporate America, with hashtags such as #FreeLuigi used hundreds of thousands of times across social platforms in the weeks following the assasination.
This online glorification quickly translated into real-world incitement. Merchandise funding the legal defense of and celebrating Mangione appeared for sale, and more ominously, “Wanted” posters targeting other financial services and healthcare CEOs were posted in New York City. Online “hit lists” publicizing the names and salaries of other insurance executives were circulated, explicitly framing them as legitimate targets.
Examples of websites selling merchandise glorifying the assassin behind the murder of the UnitedHealthcare CEO Brian Thompson.
‘Wanted’ posters that were put up in Manhattan after the assassination of Thompson.
This phenomenon also saw the birth of coded language; terms like “Luigi’d” and “pull a Luigi” emerged as shorthand for attacking a corporate executive, allowing users to advocate for violence while attempting to evade automated content moderation tools. The muder of Brian Thompson also established a clear and rapid progression: a singular act of violence, amplified and validated online, created a contagion of credible threats that endangered an entire industry sector.
Calls for further anti-corporate violence spike after Midtown attack
The Midtown shooting is poised to trigger a similar, and potentially broader, contagion effect. While Tamura’s grievance was specific to the NFL and CTE, the murder of BREIT CEO LePatner provides fertile ground for new, unrelated grievances to be grafted onto the event.
LePatner was likely a collateral victim, not a dedicated target, killed because she was in the lobby of a building targeted for another reason. However, in the wake of the incident, our analysts observed a surge in online discourse that attempted to obscure this or fuel speculation over the official claims about Tamura’s motivations in an attempt to distract from the possibility that he may have intentionally targeted Blackstone for perceived legitimate grievances.
An indicative example of the proliferation of such harmful narratives includes a social post by a social media influencer with over 3.4 million followers on a mainstream social platform. This post, which had accrued over 4.2 million views at the time of analysis falsely alleged that “the institutions and ruling class don’t want this [BREIT’s] connection to this incident because then people will start educating and talking about it”.
A viral social media post spreading misinformation about LePatner in an attempt to justify her killing.
Similarly, the comments section of this post are peppered with slogans like “Make Billionaires Afraid Again” and implicit threats against other corporate executives. This conspiracy-inflected, opportunistic narrative building is a hallmark of online radicalization.
Mapping risk patterns in the aftermath of anti-corporate violence
In our work to safeguard companies and their people, Resolver is seeing a concerning pattern emerging that generates a cycle of violent sentiment in the aftermath of corporate-targeted violence. Following the tragic events of the Midtown shooting, online risks observed in the case of the assassination of Thompson were mirrored, with significant implications to the security, reputation, and wellbeing of those targeted.
Harassment of the victims
Ideologically driven detractors and trolls increasingly take the opportunity offered by violent events to harass victims online through blame displacement, claiming that they are responsible for the violence enacted on them or that they deserved to be targeted.
Similar to the aftermath of the assassination of the UnitedHealthcare CEO, hostile users glorified LePatner’s death and targeted her with misogyny, antisemitism, and claims that she deserved to be killed due to perceived corporate greed. On 4chan alone, Resolver identified 21 threads with hundreds of posts dedicated to harassing LePatner after her death.
A 4chan post representative of the hateful rhetoric amongst the fringe online communities.
Backlash to impacted companies and wider sector
As with previous cases of anti-corporate violence, the Midtown shooting saw spill over effects to wider sectors connected to the impacted companies and victims of the attack.
Despite the NFL being the most likely target of the attack, Blackstone received significant attention from detractors of the firm and its business practices. Criticism amplified by the shooting attracted abusive rhetoric to other Blackstone executives and conspiracy theories of attempting to conceal information about the attack.
Resolver analysts have also seen an increase in violent rhetoric across the wider financial services sector, likely due to the increased attention on the sector as a result of the murder.
Incitement to further violence
Reactions to the shooting included glorification of the attack and calls for further violence by anti-capitalist users. This included references to slogans and evasion terms generated by the assassination of the UnitedHealthcare CEO, hijacking of hashtags discussing the topic with violent messaging and imagery, and direct threats to other organizations referencing the attacker.
Such narratives contribute to the normalization of the use of violence to address grievances with corporate entities and their people, elevating the risk of copycat attacks and other criminal acts.
How Resolver helps brands enhance their executive protection
In an environment where violence is normalized as a viable recourse to address grievances, with victims denigrated while the actions of perpetrators are glorified and justified, the probability of such attacks increases. And should the inconceivable occur, despite every effort to prevent it, brands are faced with a surge in backlash not only directed to those that are directly impacted, but through spillover to the wider sector.
Finding and fixing security weaknesses before an adversary can exploit them should be the first step in an online security risk assessment programme. Resolvers Digital Footprint Reports (DFR) are a core part of this. By meticulously cataloging an executive’s online exposure, we can identify specific vulnerabilities that an attacker would use for planning any attack.
Preemptive Actions: Hardening the Target
 |
Physical Security: Identifying and securing exposed residential information, such as home addresses found in public databases or dark web leaks. This includes analyzing satellite and street-level imagery that reveals property layouts and potential entry points. |
 |
Lifestyle & Pattern-of-Life Exposure: Pinpointing an executive’s predictable locations by analyzing their own and their family’s social media posts. Information about event attendance, frequented restaurants, or a child’s school activities creates a “pattern-of-life” map for adversaries. Our reports find these vulnerabilities, allowing for targeted security planning and advisories on safer online sharing. |
 |
Digital Hygiene: Discovering exposed PII like phone numbers, emails, dates of birth, and even Social Security Numbers in dark web data leaks. This allows for the scrubbing of data, changing of compromised passwords, and increased vigilance against phishing and social engineering schemes. |
Proactive Measures: Social Listening and Online Risk Intelligence
The active and continuous scanning of the online landscape across traditional social media, online forums and geo-location based security reporting apps is the basis of our real-time Security offering. Proactive measures enabled by our monitoring include:
 |
Identifying Direct Hostility: Discovering specific individuals or groups expressing grievances or direct threats and assessing the credibility of these threats. |
 |
Tracking Escalation: Monitoring a person of interest’s online rhetoric over time to see if it becomes more violent or specific, indicating an increased risk of action. |
 |
Situational Awareness: Using geofenced monitoring around offices or residences to detect planned protests or potential surveillance activities mentioned on social media. |
Next Steps
The violent events in Midtown are not an anomaly but a confirmation of a dangerous new pattern in corporate security. The aftermath mirrors the response to the Brian Thompson assassination, where a singular act of violence was amplified online, creating a contagion of credible threats that endangered an entire industry. In this new environment, corporate grievances, whether real or perceived, are validated and glorified online, normalizing violence as a legitimate response.
This digital validation directly increases the probability of copycat attacks and other criminal acts, creating a cycle of violent sentiment. For companies, the dilemma is twofold: they must harden physical targets while also managing the chaotic digital aftermath of any violent event. Protecting your people is no longer just about securing buildings; it’s about understanding and mitigating the online risks that can manifest as real-world, physical attacks.
In an era where online rhetoric can escalate to physical violence, a reactive security posture is no longer enough. Resolver’s Social Listening and Online Risk Intelligence services provide the preemptive and proactive intelligence needed to protect your executives and organization.
Talk to an expert today about protecting your people and your brand.
