Mark Herring — fatal swatting over a Twitter handle (Tennessee, 2020)

What happened

On April 27, 2020, Sumner County, Tennessee deputies responded to a 911 call reporting a violent incident at the home of Mark Herring, 60, in Bethpage. The call was a hoax. When Herring came outside in response to the police presence — armed, after hearing someone on his property — he was ordered to put his hands up. He complied, then attempted to crawl under a fence in his yard and collapsed. He was pronounced dead from a heart attack.

Federal prosecutors later established that the call was the final step in an extortion campaign aimed at acquiring Herring's Twitter handle, @Tennessee, which he had held for years. The Tennessee Volunteers fan refused to give it up. The extortionists escalated.

How it started

Shane Sonderman, then 20, led a group attempting to obtain valuable Twitter handles by intimidation. After Herring rejected their demands, Sonderman posted Herring's home address in a Discord server frequented by the group. An unnamed minor in the United Kingdom then placed the swatting call.

The address itself was acquired through publicly available channels — the kind of records a basic people-search lookup returns. No hack, no insider leak. Just a name attached to an address on a broker site or equivalent public source.

Sonderman pled guilty to conspiracy as part of a plea bargain that dropped additional charges and was sentenced to 5 years in federal prison plus a $250,000 fine.

What this means for you

For sworn officers, judges, healthcare workers, and any first responder with online accounts that connect to a public profile: the address-finding step is what makes this kind of harassment campaign feasible. Once an extortionist or harasser has the home address, the rest is mechanical.

Removing your address from broker pages doesn't eliminate the harassment risk — but it raises the cost of the operational step (finding where you live) that turns online conflict into physical-world consequence.

For more on the swatting threat shape and recovery steps, see /swatting and /swatting/recovery.

---

Editorial rules: Only public, already-reported incidents. Never name a non-public victim. Always end with the prevention takeaway tied to our service. Cite at minimum one public source per claim.