In 2017, a man opened fire on his estranged wife, a special needs teacher at an elementary school in San Bernardino, California, killing her and a student before taking his own life.
The man who carried out the attack had a history of domestic violence, according to the U.S. Secret Service, which in a first-of-its-kind report is detailing common “behaviors of concern” it says are often exhibited before attackers carry out violence.
Nearly three-quarters of those who carried out workplace attacks exhibited such behaviors of concern, according to the report released on Wednesday.
In this July 28, 2026, file photo, a U.S. Secret Service Uniformed Division officer patrols outside the perimeter of the White House in Washington, D.C.
Kevin Carter/Getty Images, FILE
In addition to its protection and financial crime duties, the U.S. Secret Service also houses the National Threat Assessment Center (NTAC), which examines targeted violence and publishes research papers on the topic.
Lina Alathari, who has a Ph. D. in cognitive neuropsychology and leads the center, told ABC News in an interview the report studied incidents from 2016 to 2020. It’s also based on interviews with workplaces that practice the training the Secret Service recommends.
“One of the main findings from our report examining mass attacks was that over 40% of the attackers had a history of domestic violence, and when you parse out these 50 subset of workplace attackers, that number goes up to 53%,” Alathari said adding that the incidents continue to happen on a “monthly or weekly basis.”
Alathari told ABC News the warning signs of the attacks fell on a “continuum.”
According to the report: “Some attackers engaged in violence directed at romantic partners or relatives, prompting victims to seek protective orders or restraining orders against the attackers.”
About two-thirds of attackers had prior criminal charges, according to the report.
“Other behaviors that elicited concern included attackers making disturbing or threatening statements, exhibiting strange or unusual behaviors, and stalking and harassing others,” the report stated.
The incidents the Secret Service studied found that perpetrators were familiar with the workplace — whether they were a former or current employee, a romantic partner who worked at the site or a customer, according to the report.
The report lays out a series of warning behaviors and signs that are typical for those who might carry out targeted workplace violence, like a 22-year-old service member who “experienced multiple stressors, including chronic pain resulting from a motorcycle accident, the ailing health of a loved one, harassment from peers, and numerous reprimands and citations at work due to poor performance and tardiness,” before carrying out an attack that killed two on base and injured a third person.
In nearly all of the 50 attacks the Secret Service examined the attacker experienced some kind of stressor, according to the report. Of the attacks studied, retail locations were the most targeted, followed by restaurants, and manufacturing or distribution centers.
The Secret Service found that nearly all of the attacks were carried out by males who acted alone.
According to the report, half of the employees that carried out workplace violence had disciplinary records, such as a man who shot and killed four co-workers in an HR meeting after being given notice that he was being terminated.
The Secret Service said that workplace violence can be prevented by implementing proactive steps — such as securing the support of senior executives at the company to create a team that is aware of threatening or concerning behaviors.
“The Secret Service wanted to make sure that an organization of any size, small, medium, or large, can take this framework, and it’s a scalable blueprint for them to start establishing these programs or refine existing programs,” Alathari said, adding the Secret Service uses the threat assessment model to protect the president and others every day.
“What we’re telling organizations is you have to have resources and trainings for employees to recognize the warning signs, but also the avenues to report this behavior so that someone in the organization has the responsibility for taking action to make sure that preventing a future attack,” she said.