Skip to main content
Open this photo in gallery:

An undated New York City Police Department (NYPD) handout image obtained by Reuters on Dec. 5, 2024, shows an individual wanted for questioning in connection with the killing of UnitedHeatlhcare CEO Brian Thompson, in an unknown location.NYPD/Reuters

The masked gunman who stalked and killed the head of one of the largest U.S. health insurers had the words “deny,” “defend” and “depose” emblazoned on his ammunition, echoing a phrase used by industry critics, two law enforcement officials said Thursday.

The words were written in permanent marker, according to one of the officials, who were not authorized to publicly discuss details of the investigation into the killing of UnitedHealthcare CEO Brian Thompson and spoke to The Associated Press on the condition of anonymity.

With the gunman still at large, police collected key clues Thursday as they tried to identify the killer.

Investigators now believe the suspect may have travelled to New York last month on a bus that originated in Atlanta, one of the law enforcement officials said.

Police also released new photos Thursday of a person wanted for questioning.

The images, showing an unmasked man in the lobby of a Manhattan hostel, add to a collection of photos and video that have circulated since the shooting – including footage of the attack itself, as well as still frames of the suspected gunman stopping at a Starbucks beforehand.

Explainer: What we know about the deadly shooting of UnitedHealthcare executive Brian Thompson

Police and federal agents have been collecting information from Greyhound in an attempt to identify the suspect and are working to determine whether he purchased the bus ticket to New York in late November, the official said.

Thompson, 50, died in a dawn ambush as he walked from his midtown hotel to the company’s annual investor conference at a Hilton across the street, blocks from tourist draws such as Radio City Music Hall, the Museum of Modern Art and Rockefeller Center. The reason for the killing remained unknown, but New York City police say evidence firmly points to it being a targeted attack.

The messages on the 9 mm ammunition found at the scene of the shooting mimic the phrase “delay, deny, defend,” which is commonly used by lawyers and insurance industry critics to describe tactics used to avoid paying claims.

It refers to insurers delaying payment, denying a claim and then defending their actions. Health insurers like UnitedHealthcare have become frequent targets of criticism from doctors and patients for denying claims or complicating access to care.

Investigators also recovered a cellphone from a pedestrian plaza through which the shooter fled. Inside a nearby trash can, they found a water bottle and protein bar wrapper that they say the gunman purchased from Starbucks minutes before the shooting. The city’s crime lab is examining those items for DNA and fingerprints.

Investigators were still trying to obtain additional information from the phone Thursday, the law enforcement official said.

A tip that the shooter may have stayed at a hostel brought police Thursday morning to at least two such establishments on Manhattan’s Upper West Side, according to one of the law enforcement officials briefed on the investigation. The photos made public Thursday were taken in the lobby of the HI New York City hostel.

“We are fully co-operating with the NYPD and, as this is an active investigation, can not comment at this time,” hostel spokesperson Danielle Brumfitt said in an e-mailed statement.

Investigators believe the suspect used a fake New Jersey identification card when he checked in at the hostel, said one of the officials who spoke with The AP.

Open this photo in gallery:

A poster is attached to a lamp post outside the Hilton hotel near the scene where the CEO of UnitedHealthcare Brian Thompson was shot dead in midtown Manhattan, in New York City, U.S., Dec. 5, 2024.Mike Segar/Reuters

Employees who work at the hostel told investigators they remembered a man who almost always wore a mask when interacting with them or passing by the front desk and that the person wore a jacket that looked like the one worn by the man pictured in surveillance images released after the shooting, the official said.

After the shooting, police said the gunman fled on a bicycle and was last seen riding into Central Park.

Members of the public have flooded police with tips – many unfounded. Police searched a Long Island Rail Road train Wednesday night after a commuter claimed to have spotted the shooter, but they found no sign of the gunman.

“We’re following up on every single tip that comes in,” Assistant Commissioner Carlos Nieves, a police spokesperson, said. “That little piece of information could be the missing piece of the puzzle that ties everything together.”

Based on surveillance video and evidence from the scene, investigators believe the shooter had at least some firearms training and experience with guns and that the weapon was equipped with a silencer, one of the law enforcement officials told the AP.

Investigators were also looking into whether the suspect had pre-positioned a bike as part of an escape plan, the official said.

Security video shows the killer approaching Thompson from behind, levelling his pistol and firing several shots, barely pausing to clear a gun jam while the executive tumbled to the sidewalk. Cameras showed him fleeing the block across a pedestrian plaza before getting on the bicycle.

Police released several images of the man wearing a hooded jacket and a mask that concealed most of his face – a look that would not have attracted attention on a chilly morning. They’ve also used drones, helicopters and dogs in an intensive search for the killer, while also interviewing Thompson’s coworkers, searching his hotel room and scouring his social media.

Thompson, a father of two sons who lived in a Minneapolis suburb, had been with Minnetonka, Minnesota-based UnitedHealthcare since 2004 and served as CEO for more than three years.

His wife, Paulette, told NBC News on Wednesday that he told her “there were some people that had been threatening him.” She didn’t have details but suggested the threats may have involved issues with insurance coverage.

The insurer’s parent company, UnitedHealth Group Inc., was holding its annual meeting in New York to update investors on its direction and expectations for the coming year. The company ended the conference early in the wake of Thompson’s death.

UnitedHealthcare provides coverage for more than 49 million Americans and brought in more than $281 billion in revenue last year. It is the largest provider of Medicare Advantage plans in the U.S. and manages health insurance coverage for employers and state and federally funded Medicaid programs.

In October, UnitedHealthcare was named along with Humana and CVS in a Senate report detailing how its denial rate for prior authorizations for some Medicare Advantage patients has surged in recent years.

Open this photo in gallery:

Members of the New York police crime scene unit pick up cups marking the spots where bullets lie as they investigate the scene outside the Hilton Hotel in midtown Manhattan where Brian Thompson, the CEO of UnitedHealthcare, was fatally shot Wednesday, Wednesday, Dec. 4, 2024, in New York.Stefan Jeremiah/The Associated Press

Report an editorial error

Report a technical issue

Tickers mentioned in this story

Study and track financial data on any traded entity: click to open the full quote page. Data updated as of 24/03/26 6:40pm EDT.

SymbolName% changeLast
UNH-N
Unitedhealth Group Inc
+1.02%272.28

Follow related authors and topics

Authors and topics you follow will be added to your personal news feed in Following.

Interact with The Globe