NY - UnitedHealthcare CEO Brian Thompson fatally shot in Midtown. #4

[Let’s Bagel]

Was a ransom paid or promised in the cyber attack?

The CEO of United Healthgroup (UHC's parent company) confirmed that the company paid $22M in ransom. There were rumors that the hackers came back and asked for more and that the company didn't pay, but I haven't seen that confirmed anywhere.
Keep in mind that the hack was on Change Healthcare (another United Healthgroup company), which is the claims clearinghouse for UHC. It was not a direct attack on UHC systems. I don't think this idea that hackers were able to access Thompson's calendar in this manner are relevant.

 

[CamilleBSP]

Good article on reasons why he hasn't been caught yet. Many have been theorised over the hours here but it's a good summary:

Why finding the suspected CEO killer is harder than you might think​

Surveillance Footage

• It could take weeks to find and scrub through a massive array of video footage from all the places where the gunman may have travelled.
• Suspect appeared on camera numerous times but always kept his hood over his head and wore a mask in public places.

Central Park evidence

• Spanning 843 acres, Central Park is larger than the country of Monaco.
• Suspect entered and left the park within minutes.

Police tips naming suspect

• Vigilante justice- thoughts that the man is enacting vigilante justice against a health care system that values profits over patients’ lives could hinder some people’s motivation to report possible sightings of him.
• Tens of thousands of social media users mocked the death of the health insurance CEO and showed little sympathy after the killing.

Facial recognition

• No central database - NYPD can't just search one database. If suspect is not a New Yorker, or committed a crime in NY before they are unlikely to have his image on file. Facial recognition requires cooperation from local LE across the US searching each of their databases.
• LE do not have automatic access to DMV database. "It’s a legal permissioning process."

Phone data

• "It’s a very complex matrix of hardware and software, and that’s kind of what determines whether or not law enforcement has the capability to get past that locking mechanism."
• “you might be able to get into an iPhone 7 running iOS whatever, but you couldn’t get into one if it was running a different iOS"
• "Once you get into the phone, then you’re dealing with the problem of encrypted content"

DNA from the water bottle

• Suspects DNA may not be in the database
• Familial DNA (if releatives are in the database) takes longer to process

“It’s far more complicated than it seems from the outside.” - former FBI Deputy Director Andrew McCabe.

https://edition.cnn.com/2024/12/07/us/suspect-search-unitedhealthcare-ceo/index.html

What kind of phone would it be that they took so long to break into?
Even the newest iPhones with the most up to date iOS wouldn’t take long.

 

[annpats]

What do we make of the phone call minutes before the shooting? The most obvious answer seemed to be he was on the phone with an accomplice but LE seems to think at this point that’s not the case

I do wonder if the perp was on the phone with an accomplice in the hotel confirming which door BT was exiting through.

 

[Inthedetails]

Huh, this is intriguing i must say. I can’t rule it out at this point

Didn't Murdaugh in South Carolina arrange for someone to shoot him as a form of suicide (though it didn't work and he survived). Murdough was facing massive legal troubles. Not to derail this thread about that case!

I don't think an elaborate suicide happened in this case, but I don't discount it as a possibility.

The reason I don't think it happened is because of the victim - imo, if he wanted to hire a hit man on himself, I think the hit would be understated.

jmopinon

 

[armchairagatha]

The CEO of United Healthgroup (UHC's parent company) confirmed that the company paid $22M in ransom. There were rumors that the hackers came back and asked for more and that the company didn't pay, but I haven't seen that confirmed anywhere.
Keep in mind that the hack was on Change Healthcare (another United Healthgroup company), which is the claims clearinghouse for UHC. It was not a direct attack on UHC systems. I don't think this idea that hackers were able to access Thompson's calendar in this manner are relevant.

So this hit could have been for more ransom? Pay up, you can see what we are capable of. Hence the show in NYC, just like 9/11. Pay up or more of you will end up like BT could have been the message to the UH group. It is an intriguing idea! It seems to check off most of the boxes. JMO

 

[RobSA]

I like this theory. I'll just add that in the video, with BT in a bright-blue, very not CEO-like jacket, he's walking weirdly. Not a brisk, getting where he's going type of walk, yet not a gawking tourist walk. It's a stiff, slow walk. Like you know something is going to happen but you're not sure exactly when.

There is close to 0% chance that if BT set up a suicide that he would have the guy use that particular gun. He would want something more efficient. He wouldn't want to be shot in the leg and wait for the guy to reload.

 

[ElizaKate]

What kind of phone would it be that they took so long to break into?
Even the newest iPhones with the most up to date iOS wouldn’t take long.

This article is just there to explain some of the reasons it may be taking longer than the layperson thinks it should. LE may have actually already got into the phone. Don't know yet.

There was one MSM article that cited the phone as a "Motorola burner phone". Don't think this has been corroborated by other outlets yet.
[ETA found the article citing Motorola not sure how reliable this source is - NYPD Finds Backpack Suspected to Belong to Killer of CEO]

 

[no nonsense]

Sad. From medscape:
Physicians Offer Little Sympathy for Slain Insurance CEO

 

[CamilleBSP]

The CEO of United Healthgroup (UHC's parent company) confirmed that the company paid $22M in ransom. There were rumors that the hackers came back and asked for more and that the company didn't pay, but I haven't seen that confirmed anywhere.
Keep in mind that the hack was on Change Healthcare (another United Healthgroup company), which is the claims clearinghouse for UHC. It was not a direct attack on UHC systems. I don't think this idea that hackers were able to access Thompson's calendar in this manner are relevant.

But BT could’ve been personally hacked by the killer for the purposes of knowing more about his schedule. That’s not far fetched if we think he went through so much preparation to enact this killing.

 

[CamilleBSP]

This article is just there to explain some of the reasons it may be taking longer than the layperson thinks it should. LE may have actually already got into the phone. Don't know yet.

There was one MSM article that cited the phone as a "Motorola burner phone". Don't think this has been corroborated by other outlets yet.
[ETA found the article citing Motorola not sure how reliable this source is - NYPD Finds Backpack Suspected to Belong to Killer of CEO]

At this point they probably did get into it, but it seems that it took a couple days.

 

[Inthedetails]

Would the shops have been open that early? The few times I've been there I've gone by subway and had no idea there was a shopping area!

Oh, good point. I didn't think about the time of day. The clothing stores likely would be closed. Discard the clothes shopping idea!

jmo

 

[freewill_is_an_illusion]

I'm still leaning towards BT setting up the murder himself.
1. Scheduled it for NY so that it will be far away from his wife and kids. He knows it will be bad for them either way, but setting it up in NY is almost like a buffer between the two places so that locals don't have to deal with it, hence involving his family. Anyone looking to kill him would find it easier in the small suburb in Minnesota: less cameras, less traffic, less police experience in these kinds of killings. So much easier in Maple Grove, Minnesota than NYC, NY.
2. He was under investigation with insider trading. Maybe he was afraid the money would be taken from him, thus his kids and estranged wife would be left with nothing, plus the shame of him being found guilty and possibly going to jail. He would rather die than go to jail or his boys be ashamed of him. Plus he had life insurance going to them.
3. Shooter had no qualms about going to Starbucks less than 30 minutes before shooting. He had no worries about "missing" the timeframe of BT walking out, so he knew absolutely what time BT would walk out. How? Only BT would know as no one was with him. Even if a bellman would tip him off, he sure as heck would not be hanging out getting a latte and missing the chance when bellman would call him with the tip "Hey, he just got off the elevator." I think he was on the phone with BT himself who said "I'm heading down right now. And I've got on a bright blue blazer."
4. BT wore a bright blue jacket -- not something a CEO going to a conference would wear. Plus it was frigid. BT worth millions. Would have had a nice suit, plus overcoat. And I don't think BT had any kind of bag with him. Most people going to a daylong conference would have his laptop bag. I think BT knew he was NOT going to need his laptop, so he left it behind. BT was 50 years old. Young enough to be very techy savvy. My adult kids and my husband all rely on their laptops at work: leaving it in a hotel room while going off to work for a day in NYC would make no sense at all.
5. Hitman was in NYC for 10 days. I think he was given $$ ahead of time. Thought, well, I might as well visit NYC because they will be looking for me afterwards, so I'll just go early and see the sights. BT was in town for just one day conference, so it's not like Hitman was looking at BT's regular activity for ten days.
6. Bullets being labeled was a setup to let everyone think it's a disgruntled insurancee or their family member.
7. BT used to have security. Why not in NYC?
8. Hitman seemed too casual to be on a personal vendetta. More of a professional hitman who knew he had a job to do, but was experienced enough that this was not too big of a deal. If I was wanting revenge for a loved one or for myself, I would be focused on getting the job done: in Maple Grove closer to his home so his loved ones could experience the pain I had closer to them, not seeing the sights in NYC, not smiling at the hostel employee, not smiling at all. NYC is way too expensive to do a hit there and everyone knows there are cameras everywhere. Doing it in Maple Grove would have been so much easier and less newsworthy.

I don't think BT is walking weirdly, and for me the blue jacket is just a normal blazer a CEO might wear. Also wouldn't he ask the hitman to make a headshot so it doesn't hurt... I know I would.

Also personally not sure a CEO would take a laptop to a conference, they don't do much work at the best of times. At a conference he's just networking, his PA would take notes, send emails, setup any meetings and follow ups for him, bring slides for a presentation etc.

 

[Curiousobserver]

What kind of phone would it be that they took so long to break into?
Even the newest iPhones with the most up to date iOS wouldn’t take long.

His actions now seem so orchestrated that perhaps this phone doesn't contain anything useful and they are just trying again and again to be sure. I seriously doubt they didn't crack a burner phone by now.

He seems to have left things on purpose when he really didn't need to- water bottle, energy bars, backpack, phone. He could have been in a hurry, or he could be very clever, hard to tell at this point.

 

[annpats]

Might take genetic genealogy a few days to identify a sociopathic twentysomething from vanilla America who had a close family member die after a coverage dispute,

What (or where) is "Vanilla America"...??

 

[CamilleBSP]

So this hit could have been for more ransom? Pay up, you can see what we are capable of. Hence the show in NYC, just like 9/11. Pay up or more of you will end up like BT could have been the message to the UH group. It is an intriguing idea! It seems to check off most of the boxes. JMO

That’s not how ransomware groups operate, though. It’d be a very first time and really unprecedented!

 

[Elliot_Alderson]

But BT could’ve been personally hacked by the killer for the purposes of knowing more about his schedule. That’s not far fetched if we think he went through so much preparation to enact this killing.

Well I would think LE would have already easily found that information out at this point by going through BT's phone and email.

 

[MesquiteO21]

Didn't Murdaugh in South Carolina arrange for someone to shoot him as a form of suicide (though it didn't work and he survived). Murdough was facing massive legal troubles. Not to derail this thread about that case!

I don't think an elaborate suicide happened in this case, but I don't discount it as a possibility.

The reason I don't think it happened is because of the victim - imo, if he wanted to hire a hit man on himself, I think the hit would be understated.

jmopinon

Yes I believe that crazy son of a gun did!

I’m not discounting it as a possibility either. I’d love to know BT’s demeanor and actions in the weeks leading up to this to see if there was any deviation from his normal disposition and/or habits
Jmo

 

[armchairagatha]

So this hit could have been for more ransom? Pay up, you can see what we are capable of. Hence the show in NYC, just like 9/11. Pay up or more of you will end up like BT could have been the message to the UH group. It is an intriguing idea! It seems to check off most of the boxes. JMO

Elaborating on the boxes this theory checks:
1. Motive - money, lots of it
2. Choice of NYC - to send a message to UH group and others that the hackers mean business. They made sure the actual shooting was captured on video for the world to see.
3. The coolheaded shooter - screams foreign assassin or hitman without a personal motive
4. The fact that they haven’t ided him so far or no one has outed him on social media - foreign mafia
5. The messages on the bullets - warning to UHC that these guys mean business.
6. Access to BT’s movements - easy for a hacking group to get access to his phone and track him remotely
<Edit> if not the hacker group, then foreign organized crime group. The checkboxes still work.
JMO

 

[freewill_is_an_illusion]

What kind of phone would it be that they took so long to break into?
Even the newest iPhones with the most up to date iOS wouldn’t take long.

no way this dude had anything other than a dumb burner phone with nothing on it whatsoever. No saved contacts. We haven't heard anything because there's nothing to crack on the phone.

 

[Inthedetails]

Sad. From medscape:
Physicians Offer Little Sympathy for Slain Insurance CEO

FWIW, "little sympathy" is a lot different than cheering for a murderer, imo.

We don't have to like a murder victim in order to condemn murder.

jmo