Nancy Guthrie kidnapping may be linked to violent ‘wrench attack’ cybercrime, expert says
TUCSON, ARIZONA: Nearly four months after Nancy Guthrie, the mother of Savannah Guthrie, was abducted from her Tucson home, investigators are still searching for answers in a case that has shocked residents and left her family waiting for a breakthrough.
The mystery surrounding the disappearance took another unsettling turn this week after a retired law enforcement official suggested the kidnapping may be tied to a rare and violent cybercrime tactic known as a “wrench attack.”
'WRENCH ATTACK' THEORY: The masked man on Nancy Guthrie's doorbell camera carried a gun like 'a bit of a doofus,' according to a retired detective — but someone far more sophisticated may have sent him there.
— Fox True Crime (@FoxTrueCrime) May 21, 2026
Expert Lisa J. Miller, a retired Colorado detective, says 'wrench… pic.twitter.com/u2iitCbr6C
Lisa J Miller, a former law enforcement executive at the Colorado Attorney General’s Office, told Fox News Digital that the case carries several signs associated with these attacks, in which criminals use threats, violence, or kidnapping instead of traditional hacking methods to gain access to passwords, accounts, or money.
Expert links Nancy Guthrie case to cybercrime
Nancy Guthrie was reportedly taken from her home in Tucson’s Catalina Foothills neighborhood by a masked and gloved man.
Authorities have not identified a suspect, revealed a motive, or confirmed whether Nancy is alive. A reward of more than $1.2 million has been offered for information connected to the case.
According to Miller, some details in the investigation immediately stood out as unusual.
“In the beginning of this Nancy Guthrie case, we're all taking a look at it, and we're seeing things that just didn't seem to fit,” Miller told Fox News Digital. “What we're seeing with Nancy Guthrie is not a typical wrench attack.”
Miller explained that in most wrench attacks, cybercriminals avoid complex hacking altogether and instead pressure victims directly through fear or violence.
She also pointed to surveillance footage captured by a Nest doorbell camera showing a man outside Nancy’s home both on the day of the kidnapping and again nearly three weeks earlier.
“The street-level thug theory fits with what we're seeing in the Guthrie case, because when the FBI released the pictures of this porch guy, and I've referred to him from the beginning as 'porch monster,' I mean, the guy comes across as a bit of a doofus,” Miller said.
“Look at his getup, look at how he carries his firearm… yet there's some very sophisticated elements to this case that again falls in line with what we see in a traditional wrench attack,” she added.
Nancy Guthrie case revives community fears
Miller said sophisticated cybercriminals behind such crimes are often highly skilled and may operate overseas from countries without extradition agreements with the United States.
“They know where to go,” she said. “They know how to hide their digital tracks, and they know where to operate from.”
She also believes at least some of the ransom demands connected to the case may have been legitimate.
“I don't think for a minute, and I've said before from the early stages, that the FBI would have put Savannah Guthrie [and] her family through the trauma of recording those videos if they did not believe that there was something real behind these videos,” Miller said.
However, investigators have already dealt with at least one fake ransom attempt. Fox News reported that 42-year-old Derrick Callella of California was arrested after allegedly sending a false ransom demand linked to the case.
Despite the growing speculation, the Pima County Sheriff's Department has not publicly backed the wrench attack theory.
“The Pima County Sheriff's Department has not received any reports referencing 'wrench attacks' in our community,” a department spokesperson said in a statement cited by Fox News.
“The investigation into Nancy Guthrie's disappearance remains active and ongoing. When there is a significant update, it will be shared publicly.”
Community fears grow as residents recall dark history in Catalina Foothills
The case has also reopened painful memories for some longtime residents in the Catalina Foothills area.
Local outlet KVOA News 4 Tucson reportedly compared the fear surrounding Nancy Guthrie’s disappearance to the era of a criminal responsible for dozens of home invasions in the area during the 1980s.
That case ended after police identified suspect Brian Larriva, who died by suicide before he could be arrested.
Residents now say the latest case has once again shaken the quiet community. “We're getting attention for something bad again,” one neighbor told KVOA.
Still, many residents say the tragedy has also brought people closer together.
“We get closer with each tragedy. We are a close-knit community. Nothing or no case will ever change that,” the neighbor added.