The disappearance of Nancy Guthrie has entered a chilling new phase, deepening fears for the 84-year-old mother of three and raising urgent questions about who may be responsible. Ten days after she was last seen, the FBI released images and short video clips recovered from the doorbell camera at her Catalina Foothills home. The footage shows a masked individual carrying a backpack and what appears to be a firearm in a front waist holster. In the clips, the individual seems to be attempting to disable or obscure the camera, at one point using branches to block its view.
The release of the footage marks a dramatic turn in a case that has already unsettled Tucson and drawn national attention because of Nancy Guthrie’s family. She is the mother of Today Show host Savannah Guthrie and has long been described by relatives as mentally sharp but physically limited in mobility. Authorities have stressed that she requires daily medication, a factor that intensifies the urgency of the search.
According to a timeline provided by Pima County Sheriff Chris Nanos, Nancy Guthrie was last seen on the evening of Saturday, January 31. At 5:32 p.m., she took an Uber to a family member’s home for dinner. Around 9:50 p.m., her son-in-law, Tommaso Cioni, drove her back to her residence in the upscale desert community north of Tucson. Security data shows her garage door opening at 9:48 p.m. and closing two minutes later.
Hours later, at 1:47 a.m. on February 1, the doorbell camera at her home disconnected. At 2:28 a.m., her pacemaker app registered a disconnection from her phone. By Sunday morning, when she failed to appear at a neighbor’s house to watch an online church service from Good Shepherd New York, alarm bells were ringing. A neighbor contacted family members, who went to Nancy’s home and, after failing to locate her, called 911. Law enforcement responded within minutes.
One of the most disturbing discoveries at the scene was the presence of bloodstains later confirmed to belong to Nancy Guthrie. Bloodstain pattern analysis conducted by a retired expert with decades of experience suggested the marks were consistent with a drip trail from a continuous source of bleeding. One possible interpretation is that she may have suffered a nose injury, resulting in a steady drip of blood as she moved or was moved. Investigators have not publicly detailed whether there were signs of forced entry.
The newly released doorbell footage has sparked questions about why it took so long for authorities to obtain and publish it. Initially, Sheriff Nanos indicated there was no video available because Guthrie did not have a subscription to Google’s cloud recording service for her Nest camera. Without a subscription, footage is not ordinarily stored in the cloud for later access.
However, investigators later secured a search warrant and worked with Google to explore whether any residual data could be recovered. Cybersecurity experts explain that cloud-based systems often process data through multiple layers of servers and development pipelines. In some cases, fragments of footage may remain temporarily stored in queues or processing systems before being purged. Authorities ultimately managed to recover the brief clips now circulating publicly.
As investigators sifted through digital evidence, ransom demands began surfacing. At least one note was sent to Tucson television stations KOLD and KGUN, while a similar message reached the national outlet TMZ. The letters reportedly included specific details about Nancy Guthrie’s home and what she was wearing that night. One demand called for millions of dollars in bitcoin, with escalating deadlines if payment was not made. According to sources cited by People magazine, initial deadlines have already passed without payment.
Federal authorities have stated that they are treating the ransom communications seriously and are in contact with the family. The FBI has emphasized that while law enforcement provides guidance, any decision regarding ransom payments ultimately rests with the family.
Complicating matters, a separate ransom message was later determined to be fraudulent. A 42-year-old man from Hawthorne, California, was arrested on federal charges after allegedly sending a text message from a VOIP number to Guthrie family members. The message referenced a bitcoin transaction and was sent shortly after the family released a public plea requesting proof of life. Investigators traced the phone line to a Gmail account registered to the suspect and determined the message originated from his California residence. Authorities have said this text was not connected to the earlier ransom notes sent to media outlets.
Meanwhile, new developments have raised additional questions. TMZ founder Harvey Levin reported that there had been activity in the bitcoin account listed in one of the ransom notes, marking the first movement associated with that address. Details about the nature or source of the activity have not been disclosed publicly.
At a recent press conference, the FBI’s Phoenix Division underscored the gravity of Nancy Guthrie’s medical condition. Officials indicated that she requires daily medication and that several days had already passed without confirmation that she was receiving it. They warned that the lack of medication alone could be life-threatening.
Despite the mounting evidence, authorities have not identified any suspects, persons of interest, or vehicles linked to the disappearance. Law enforcement searched a property in Rio Rico, Arizona, near the U.S.-Mexico border, and detained a man for questioning before releasing him hours later. The area lies just over an hour south of Catalina Foothills and less than 20 minutes from the Nogales-Mariposa border crossing, a detail that has fueled speculation but yielded no confirmed leads.
The FBI is offering a $50,000 reward for information leading to Nancy Guthrie’s recovery or to the arrest and conviction of those responsible. Investigators are urging anyone with information to contact federal authorities or the Pima County Sheriff’s Department.
The case has drawn comparisons to the kind of high-profile crimes that dominated headlines in the 1990s. Kidnappings for ransom involving adults in the United States are exceedingly rare. While organized criminal groups and cartels have engaged in kidnapping schemes, those cases typically involve migrants or occur outside U.S. borders. An abduction of an elderly woman connected to a prominent television personality, accompanied by ransom demands delivered to media organizations, does not align neatly with common domestic patterns.
If the ransom notes are authentic, the perpetrator would likely have needed detailed knowledge of Nancy Guthrie’s identity, residence, and family circumstances. The demands, which reached millions of dollars in cryptocurrency, suggest an assumption that her relatives could access significant funds. Her age and limited mobility would have made her physically vulnerable, though there is no public indication whether the kidnapper was aware of her medical needs.
The decision to send ransom communications to Tucson media outlets and a national entertainment site also hints at a perpetrator familiar with the local and celebrity media landscape. Some observers have speculated that the claim that Guthrie would be returned to Tucson within a specified timeframe could imply the abductor remains within driving distance.
For now, the investigation continues under intense scrutiny. Each passing day without confirmation of Nancy Guthrie’s safety heightens concern, particularly given her reliance on medication. Yet investigators and family members hold onto one crucial factor: if the motive is financial, the perpetrator has an incentive to keep her alive.
