Man Charged in Cyberstalking the Widow of Slain UHC CEO

Federal prosecutors have charged an upstate New York man with criminal cyberstalking the widow of murdered UnitedHealthCare CEO Brian Thompson. Shane Daley, 40, who was arrested on Wednesday, is accused of leaving a series of vile voicemail messages at Paulette Thompson’s workplace threatening her and her family.

See Also: Frost Radar™ on Healthcare IoT Security in the United States

The U.S. Justice Department in announcing the arrest and prosecution of Daley did not identify the victim of his alleged cyberstalking by name, but court papers documenting the violent and expletive-filled content of the voice messages for “Victim 1” include redacted sexist and foul references to Thompson’s wife and children, saying that they deserved a similar fate to the slain Thompson.

Thompson last December was gunned down in midtown Manhattan as he walked to a UnitedHealthCare investors meeting. Bullet casings found at the murder scene were etched with the words, “deny,” “delay” and “depose,” which are common words used by health insurers to reject medical coverage claims.

The murder immediately unleashed a tidal wave of vitriol on social media and other public outlets against UnitedHealthCare for its alleged unfair claims denial practices – and also a stunning level of public support for Thompson’s accused killer, Luigi Mangione (see: CEO’s Murder Sparks Outcry Over UHC’s Coverage Denials).

“Daley, as alleged, gleefully welcomed this tragedy and did all that he could to increase the Thompson family’s pain and suffering,” said acting U.S. attorney John Sarcone in the Justice Department’s statement. “My office and its partners will now do all that we can to hold him accountable for this vicious and outrageous conduct.”

Court documents, which include an affidavit from an FBI agent who investigated the case, said Paulette Thompson’s employer – identified only as “Company 1” – maintains records of incoming calls and voicemail messages to employees “and retains the messages on its recording system for a period of time.”

“The company’s records indicate that a phone with a phone number ending with the digits 2904 left four voicemail messages on a dedicated internal line used exclusively by Victim 1” on Dec. 4 and Dec. 7, 2024.

“Each of the voice messages was left by the same male caller, who used graphic and threatening language to directly address Victim 1,” the court papers said. “The caller also stated that Victim-1 and Victim-1’s children deserved to suffer a similar fate.” In total, the voicemails lasted between 11 and 28 seconds “and were laced with threats of continued violence,” prosecutors said.

Investigators identified Daley as the alleged caller through Company 1 phone records and also information obtained from AT&T, including call records and GPS location data related to the “2904 phone,” court documents said.

The federal cyberstalking charge filed against Daley carries a maximum term of five years in prison, a fine of up to $250,000 and a term of supervised release of up to three years, the Justice Department said.

Daley appeared before a magistrate judge in Albany on Wednesday and was released from custody after agreeing to several conditions, including GPS monitoring and refraining from possessing firearms or drinking alcohol, according to CNBC.

Neither the DOJ nor Daley’s criminal defense attorney immediately responded to Information Security Media Group’s requests for comment and additional details regarding the allegations against Daley.

UnitedHealthCare also did not immediately respond to ISMG’s request for comment.

Merging Threats

Among the disturbing issues arising from the Thompson case is the fact that sensitive and personal information leaked in data theft hacks – including contact and employer information – can make these types of targeted cyberstalking activities easier for criminals, some experts said.

“In today’s world it’s not just about the executive. It’s about their entire family. The executive is never ‘off duty,’ and as a result the entire family is brought into the limelight for all types of negative attacks, harassment and vitriol,” said Chris Pierson, CEO and founder of executive digital security firm BlackCloak.

“Given the fact that data breaches have leaked the contact information on these executives and family members and can never be removed, it’s important to have digital protection in place to try to mitigate things,” he said.

While prosecutors indicate in court documents that they identified and tracked down Daley as the alleged cyberstalker through call records, various advancing technologies and practices potentially can also affect these kinds of investigations – in both negative and positive ways, Pierson said.

“AI is enabling both sides of this equation,” he said. “That includes potentially allowing the faster identification of the accused, tracking adversaries and helping with data analysis,” Pierson said. “On the other side, it is enabling voices to be obfuscated and making attribution much harder,” he said.

“The ability to attribute a caller with a number is becoming more difficult these days given the ease of generating a fake Voice over Internet Protocol number and the anonymity this creates for an attacker,” he said.

“This will be an arms race.”

Recent trends – including Thompson’s December murder and a recent shooting attack at NFL headquarters in New York – indicate that threats involving physical and digital violence are rising, he said.

“We are seeing the violence, rhetoric and negative fervor increase. We saw the tragic Minnesota murders spurred on by access to data broker and people finder websites,” Pierson said.

“We just saw the tragic killing in New York City where executives at the NFL were allegedly the target. There is a convergence happening between physical executive protection and digital executive protection,” he said.

Meanwhile, the Trump administration’s Justice Department has indicated that federal prosecutors will seek the death penalty in their case against Mangione, the alleged killer of Brian Thompson.