Every Workplace Attacker Was Known
In all 50 workplace mass attacks the U.S. Secret Service studied, the attacker was known or knowable to the workplace before the attack.1 All 50.
What the Secret Service counted
NTAC analyzed 50 mass attacks at workplaces, a subset of the 173 mass attacks in its 2023 dataset.15 Each one harmed three or more people, not counting the attacker.16 The settings were public and semi-public workplaces: restaurants, bars, retail outlets, service centers, manufacturing and distribution facilities, healthcare settings, educational institutions and military installations.17
Across the 50 attacks, 119 people were killed and 128 were injured.18,19 Firearms were used in 43 of them (86%).20 For scale outside the study, the guide cites Bureau of Labor Statistics data showing 928 workers died in intentional homicides between 2023 and 2024.21
One note on the arithmetic before we go further. The 50 incidents involved 51 attackers, so most figures below sit on one of two bases: 50 attacks or 51 attackers. Where a figure rests on a smaller group, the count runs next to the percentage. On a base of nine, one person moves the rate eleven points, so read those as counts rather than rates.
What known or knowable actually means
NTAC defines the term: A person is known or knowable when their identity, affiliation or patterns of behavior are either already recognized, or can reasonably be identified, based on frequent or substantive contact with the workplace.2 Three groups account for all 51 attackers.3
Current or former employees, 22 of 51 (43%)
Eighteen of the 22 elicited concern from the people around them, and nine of those 18 did it at work.22,23,24 Seventeen made concerning communications, and nine of the 17 included an outright threat.25,26 Six were former employees. Five of the six had been fired.27 The gap between the termination and the attack ran from the end of the termination meeting to seven years later.28
Customers, clients, patients and visitors, 20 of 51 (39%)
Thirteen of the 20 had already behaved in a concerning or threatening way at the location they later attacked.29,30 That earlier behavior ran from getting thrown out for erratic or rude conduct all the way to threatening to kill employees or other customers.31 Twelve of the 20 had an identifiable triggering event, and every one of those triggers landed inside a month of the attack, from 2.5 hours before to two-to-four weeks.32,33 All seven bladed-weapon attacks in the study came out of this group.34
Romantic partners and relatives, 9 of 51 (18%)
Six of the nine went after an estranged or former partner at that partner's place of work.35,36 Seven had a history of threatening a partner or family member.37 Three of those seven faced criminal charges for it.38
Read those three groups as a records problem and the shape of it shows up fast. Personnel files sit with an employer. Incident logs sit with a business. Protective orders sit with a court. Domestic violence calls sit with a police department. Do any of those systems talk to each other in your jurisdiction?
How these attacks ended
The resolution data deserves more attention than it gets, and all 50 attacks are accounted for in it.
Attackers stopped on their own in 38 of the 50 attacks (76%).9 Of those 38, twenty-three died by suicide and 15 were arrested at or away from the scene.39,40 Law enforcement intervention stopped nine attackers.10 Bystanders stopped two.11 One attack ended after the attacker's weapon ran out of ammunition.12 That accounts for all 50.
Attackers died during or shortly after 30 of the attacks (60%).41 Workplace attacks ended in the attacker's suicide at a higher rate (46%) than the non-workplace mass violence incidents (16%) in NTAC's earlier public-spaces study.42
What follows is NCIER's planning judgment rather than a finding of the guide. A law enforcement agency whose plan is built almost entirely around confronting an active attacker is planning for the smaller share of these events. There were 128 injured people across the 50 attacks, and the casualty load is the part of the outcome still in play once responders are on scene.19 A plan that handles a dead or suicidal subject, an ambiguous threat picture and a mass-casualty triage problem covers more of this dataset than one that doesn't.
Bystanders are worth a second look too. NTAC's standing research finding is that bystander reporting and intervention can avert planned acts of targeted violence.43 Two of these attacks ended because somebody stepped in. The larger bystander contribution happens weeks earlier, when a person decides whether to tell anyone what they saw.
Responders have access to knowledge that HR does not
Across all 51 attackers, 33 (65%) had a history of criminal charges.44 Twenty-seven (53%) had at least one instance of domestic violence in their past, and only nine of those 27 were ever arrested or charged for it.7,8 Forty-seven (92%) had been through noteworthy life stressors within five years of the attack.45 Forty (78%) behaved in ways that elicited concern in others, and 31 (61%) behaved in ways that made an observer fear for somebody's safety.4,6
Two of those numbers carry the argument for partnership.
Start with the 27 and the nine. Eighteen people in this dataset had a domestic violence history that never produced a charge, which means whatever record exists sits somewhere other than a criminal history: a call log, a victim statement, a protective order filing, a patrol officer's or a paramedic's memory of a house. NTAC's elementary school case runs exactly that way. A 53-year-old man arrived at the school where his estranged wife worked, fired ten shots into her classroom, killed her and one of her students, injured another student and died by suicide.46,47 Restraining orders against him had already been filed by both of his ex-wives, by an ex-girlfriend and by a local pastor and her husband.48
Then the 40. Four out of five of these attackers worried somebody before they acted, and the concern usually arrived as behavior rather than as a stated threat. NTAC has found the same pattern across its research. People who pose a risk of violence don't always make direct threats beforehand, but they often communicate their intentions to those around them.49
There's no demographic shortcut available either. NTAC states it twice, once in the research summary and once in the findings on workplace attackers.13,14 Thirty of the 51 attackers (59%) had mental health symptoms before the attack, and 20 (39%) had ever received a diagnosis or treatment for one.50,51 What remains if demographics aren't useful? What's left to work with is behavior, and NTAC's own conclusion is that opportunities for intervention and prevention were often present, because many attackers elicited concern in others and were often motivated by grievances with the workplace.52
The partnership the guide asks for
NTAC's prevention model is behavioral threat assessment and management, run by a multidisciplinary team that takes principal responsibility for identifying, assessing and managing people of concern.53 The guide is direct about what that team needs from outside the organization. It calls partnerships with community agencies such as local law enforcement, social services or mental health professionals "crucial to the success of organizational BTAM efforts" (p. 38).54 Ad hoc participants on those teams can include state and local law enforcement and community mental health.55
There's a timing requirement too, written as a rule: "Establish partnerships before a time of need to support streamlined collaboration, information sharing, and crisis response" (p. 36).56
Read from the agency side, that's a standing invitation. The hospital, the school district, the manufacturing plant and the shelter in your jurisdiction each need a law enforcement contact, a mental health contact and a way to move information before the day they need it. The agency that makes the first call sets the terms.
Two cautions in the guide are worth carrying into that conversation.
The first one is about zero tolerance. NTAC finds that zero-tolerance policies have at times been overly punitive and inflexible to the circumstances and needs of individuals of concern.57 The language also fails to account for early warning signs shown before an incident, and policies like it can discourage some people from reporting concerns.58,59 A partner organization whose entire violence-prevention posture is a zero-tolerance clause in the handbook has a liability document. Never mistake that for a complete prevention program.
The second is about reporting. Employees have to feel confident reporting without fear of retaliation or punishment.60 That holds inside an emergency services agency the same way it holds in a factory. The telecommunicator who flags a caller's pattern, the firefighter who notices a crewmate coming apart, the school resource officer who hears something in a hallway: each one is running a quiet calculation about what reporting will cost them.
Schools are in this dataset
Educational institutions are among the settings NTAC included.17 The elementary school attack above was a domestic violence case that followed a victim into her classroom, and the attacker had no connection to the school beyond his marriage. One of the employee attackers in the study, a 24-year-old grocery worker who killed three coworkers, had spent the months beforehand making and sharing videos that glorified school shootings and filling journal entries with his admiration for past attackers and his plans for his own attack.61,62
For a district, the operational point is that the known-or-knowable population is wider than the student roster. Staff. Contractors. Frequent visitors. The estranged partners of employees. A threat assessment team that only looks at students is looking at part of the problem.
Healthcare and public-facing services carry the same widened perimeter. The guide cites 2023 OSHA data indicating healthcare workers were five times more likely to experience workplace violence than workers in other industries.63 In this study, every one of the seven bladed-weapon attacks came from a patient, client or visitor.34
Four things an agency can do with this
- Name a BTAM point of contact. One person a school, hospital or employer in your jurisdiction can call about somebody who worries them, without it having to be a 911 call or a report number.
- Treat an estranged partner's workplace as a location of interest. When your officers take a protective order involving an estranged partner, that partner's job belongs in the conversation. Six of the nine partner-or-relative attacks in this study happened at the partner's place of work.36
- Brief the resolution numbers to your operations staff. Law enforcement ended nine of 50, and attackers died during or shortly after 30 of them. Build the medical and scene-management side of the plan to match.10,41
- Audit your own reporting climate. NTAC's warning about retaliation applies to your agency as much as to any employer it was written for.60
NTAC says training everyone in the workplace to recognize and report concerning behavior is critical.64 Training is the easy half. The hard half is having somewhere for that report to go on the day it arrives, and standing that up is a phone call you can make this week.
Source Notes
All figures come from: National Threat Assessment Center. (2026). Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management. U.S. Secret Service, Department of Homeland Security. The publication is in the public domain. Analysis and commentary by the National Center for Integrated Emergency Response. NCIER is not affiliated with the U.S. Secret Service.
Each note links to the underlying claim in NCIER's Workplace Violence Claim Map, where the verbatim passage and the highlighted source page are published. Claim ids carry their page number: p012-05 is the fifth claim on page 12.
