Retired Detective Unveils ‘Wrench Attack’ Theory in Nancy Guthrie Case, Linking to Criminal Underworld

The unsettling incident involving the alleged kidnapping of Savannah Guthrie’s mother has disrupted traditional perceptions of cybercrime. Experts are now raising alarms that some sophisticated hackers are abandoning their usual digital tactics in favor of more physical and dangerous methods, including the use of firearms and hiring kidnappers.

Lisa J. Miller, a retired detective and former law enforcement executive with the Colorado Attorney General’s Office, highlighted this concerning development known as “wrench attacks.” In these scenarios, criminals pressure the kidnapped individuals or their families into paying ransoms. The term itself is derived from a 2009 web comic that humorously suggested a $5 wrench as an effective tool to extract passwords from someone, as opposed to the technical complexities of hacking.

In the case of Nancy Guthrie, the mother of “Today” show co-host Savannah Guthrie, an armed suspect was caught on camera tampering with the doorbell at her Tucson, Arizona home on February 1, 2026, the morning she vanished. This incident has drawn significant attention, with the FBI and media outlets sharing images of the 84-year-old to aid in the investigation.

“When we initially examined the circumstances surrounding Nancy Guthrie’s disappearance, there were elements that seemed out of place,” Miller explained to Fox News Digital. “Unlike the typical wrench attack, what we’re observing in this situation is quite different from the norm.”

“In the beginning of this Nancy Guthrie case, we’re all taking a look at it, and we’re seeing things that just didn’t seem to fit,” Miller told Fox News Digital. “What we’re seeing with Nancy Guthrie is not a typical wrench attack.”

In traditional wrench attacks, sophisticated criminals behind computers identify potential targets, then recruit local muscle to carry out the violence, she said. The “masterminds” plan out the logistics — and pay thugs a cut to do the dirty work, which in some European cases has included torturing victims until they give up their passwords, accounts or other targeted information, she said.

NANCY GUTHRIE WAS ALIVE WHEN ABDUCTED, BLOOD EVIDENCE SHOWS ‘LAST STAND’ ON FRONT PORCH: RETIRED FBI AGENT

In Guthrie’s case, Miller said it’s less likely that all of those tactics were employed because the person whose money they were likely seeking was her daughter, “Today” co-host Savannah Guthrie.

“The street level thug theory fits with what we’re seeing in the Guthrie case, because when the FBI released the pictures of this porch guy, and I’ve referred to him from the beginning as ‘porch monster,’ I mean, the guy comes across as a bit of a doofus,” Miller said. “Look at his getup, look at how he carries his firearm… yet there’s some very sophisticated elements to this case that again falls in line with what we see in a traditional wrench attack.”

MULTIPLE SUSPECTS ARE POSSIBLE IN NANCY GUTHRIE’S ABDUCTION

For one, it’s been more than 100 days since purported ransom notes were sent to TMZ and local media, Miller noted, and no one has been arrested in connection with those.

A spokesperson for the Pima County Sheriff’s Department, which is leading the investigation into Guthrie’s suspected kidnapping, said the agency has not dealt with any potential “wrench attack” crimes before. 

“The Pima County Sheriff’s Department has not received any reports referencing ‘wrench attacks’ in our community,” she wrote in an email. “The investigation into Nancy Guthrie’s disappearance remains active and ongoing. When there is a significant update, it will be shared publicly.”

SIGN UP TO GET TRUE CRIME NEWSLETTER

News outlets’ tip boxes are designed to help journalists get information from people like crime witnesses and whistleblowers without putting their identities at risk — which makes them useful tools for criminals, too, Miller said.

At least some of the early demands could have potentially been legitimate, Miller said. For one, Savannah Guthrie said as much in an interview with her “Today” colleague Hoda Kotb in March.

SAVANNAH GUTHRIE BELIEVES TWO RANSOM NOTES HER FAMILY RESPONDED TO WERE GENUINE

“I don’t think for a minute, and I’ve said before from the early stages, that the FBI would have put Savannah Guthrie [and] her family through the trauma of recording those videos if they did not believe that there was something real behind these videos,” Miller said.

At least one man, 42-year-old Derrick Callella of California, is accused of making a hoax ransom demand to capitalize on the crime without being involved in Guthrie’s disappearance. He sent the demand using less sophisticated attempts to cover his tracks and was identified and arrested within days.

LIKE WHAT YOU’RE READING? FIND MORE ON THE TRUE CRIME HUB

The typical mastermind in a wrench attack is operating from overseas, likely in a country without an extradition treaty or where the government would be hostile to cooperating with the FBI, Miller said.

“They know where to go,” she told Fox News Digital. “They know how to hide their digital tracks, and they know where to operate from.”

FOLLOW THE FOX TRUE CRIME TEAM ON X

Aerial drone shots show the home and grounds of Nancy Guthrie in Tucson, Ariz., on Tuesday, Feb. 3, 2026. Nancy Guthrie, mother of ‘Today’ show host Savannah Guthrie, is suspected of being abducted from her home earlier this week. (Fox Flight Team)

In some cases where they’ve been arrested, masterminds have been linked to more than one abduction, she said. They’re typically young and computer savvy.

“Their working knowledge of computers and digital forensics is off the charts,” she said.

Nest doorbell camera video shows a masked man wearing gloves on her front steps around the time of her abduction, as well as three weeks earlier, creeping up to the home again. Her back door was also propped open by the time police arrived hours later, prompting questions about whether more than one person was involved.

There is a combined reward of more than $1.2 million for cracking the case. The family is asking anyone with information to dial 1-800-CALL-FBI. Tipsters can remain anonymous by contacting the local Crime Stoppers affiliate, 88-Crime.

“Hopefully someone will see something, say something and allow the family to get Nancy Guthrie home,” Miller said.