Six months. That is how long Nancy Guthrie has been missing, and until last Friday, the public had never read the actual words her kidnappers wrote. That changed on July 31, when the Pima County Sheriff’s Department put out the full contents of two ransom notes tied to her disappearance. They did it for one reason: they think someone out there recognizes the way the writer talks.
The notes are grim. The second one claims Nancy is already dead. Here is what they say, why the sheriff waited six months to release them, and what still does not add up.
The case, if you missed it
Nancy Guthrie is 84 years old and the mother of TODAY co-host Savannah Guthrie. She was last seen around 9:45 p.m. on January 31, 2026, at her home in the Catalina Foothills area near Tucson, Arizona. Her family reported her missing the next day after she failed to show up at church, which was not like her.
The FBI is treating the case as a kidnapping for ransom. Six months in, there is no named suspect, no arrest, and Nancy is still gone. Investigators have surveillance images, DNA evidence, and a joint task force with the FBI, and they still cannot close it. That is the frustrating part. The release of these letters is basically a public plea for the one lead that has escaped them.
The first note named Savannah directly
The first letter landed on February 2, sent through the email news tip line at KOLD-TV, the CBS affiliate in Tucson. It opened cold and personal: “Hello Savannah, We have your mother Nancy. She is safe but scared. She will be held for ransom and once payment is received she will be released unharmed.”
Then came the demands. The writer wanted $4 million in Bitcoin by February 5. If that deadline passed, a second one was set for 5 p.m. on February 9, and the price would jump to $6 million. The note told the family that Nancy knew “her life is in your hands” and warned, “Do not play games, law enforcement will not be able to help you.” Savannah later said the family believed the notes were real and had responded to them.
Two details made investigators take it seriously
Ransom notes are a dime a dozen in a high-profile case like this. Most are junk. What set this one apart were two specifics the writer had no business knowing unless they had been inside the house.
The note described a white smartwatch lying on the floor at the foot of Nancy’s bed, and a floodlight in the backyard that had been destroyed. Neither of those details had been made public at the time. That is the kind of thing that makes a detective sit up straight. The sheriff’s department has never publicly confirmed whether those descriptions matched the actual scene, but investigators clearly gave the letter weight. It is one big reason this note, and not the dozens of fakes, ended up released to the whole country.
The second note told a much darker story
Four days later, on February 6, a second letter arrived. This one was addressed to the whole Guthrie family, and the tone had shifted hard. It opened, “Guthrie Family, We did not fully grasp the seriousness of her physical condition.”
The writer claimed Nancy had died shortly after she was taken, saying, “We believe it was heart related.” Then it got worse to read: “She is buried in nature now. Nothing you could have done could have changed the outcome.” Here is the strange part. The second note went out while the money deadline was still ticking, and both letters were sent from the same IP address. That link is a big reason investigators believe the same person or group wrote both.
Why the sheriff is betting on the writing itself
This is the whole point of releasing the notes. The sheriff’s department says the letters show “distinctive patterns of word choice, syntax, and phraseology” that reflect the writer’s own style. In plain English, everybody has verbal tics. The way you phrase things, the words you lean on, the rhythm of your sentences. Cops are betting that somebody who knows this person will read these lines and think, that sounds exactly like my coworker, my ex, my neighbor.
Savannah backed the effort with her own message, writing about the family’s “agony and despair” and adding a direct line: “Someone recognizes the writing in the ransom demand notes.” Investigators also say the letters show how the writer’s mindset and tone changed over time, which could hint at who they are and what they were thinking.
They also want you to think about people’s behavior
Beyond the writing, the sheriff’s department laid out a checklist of things to think back on. Did someone you know act off around late January or early February? They pointed to changes in mood or appearance, unexplained injuries, a broken routine, a sudden move out of the area, someone scrubbing or repairing their vehicle, or an odd interest, or oddly zero interest, in Nancy’s neighborhood or the investigation.
They also made a point of speaking to people who have stayed quiet. Some folks sit on information because of a personal relationship, fear for their safety, or worry about their reputation. The department’s message to them was blunt: “Relationships and loyalties change over time.” Translation, the person you were protecting in February may not deserve it now.
The doorbell camera is still the strongest evidence
Back in February, the FBI released footage from Nancy’s Nest doorbell camera, recorded around the time of the crime. It showed a masked, armed person walking up to the home and then covering the camera. That clip has been described as the single most important piece of public evidence in the case.
On July 31, the same day the notes came out, the department dropped another detail that reframes things. They now believe the suspect visited Nancy’s home before the abduction. That points to planning, not a random break-in. Someone knew the layout, the routine, and maybe more. Combine that with the crime scene details in the first note, and the picture is of a person who had gotten close.
Fake notes made a hard case harder
One thing that has quietly wrecked the timeline is fraud. The FBI says it received several ransom notes over the course of the investigation, and some were flat-out fake. Sorting the real from the garbage burns time and drags the family through false hope again and again.
In July, a man from Hawthorne, California, pleaded guilty to sending a fake ransom note to the Guthrie family. That is the kind of noise investigators have to filter out. The two notes released last week are the ones they consider legitimate, based on the shared IP address and those unpublished crime scene details.
There is $1.2 million on the table
The reward money in this case is real and it is big. The Guthrie family is offering $1 million on its own. The FBI is putting up as much as $100,000, and the local group 88-CRIME is offering $102,500. Add it up and it comes to more than $1.2 million, and as of the six-month mark, none of it had been claimed.
If you have anything, even something you think is too small to matter, the tip lines are open. You can call the Pima County Sheriff’s Department at 520-351-4900, the FBI at 1-800-CALL-FBI (1-800-225-5324), or 88-CRIME to stay anonymous. Sheriff Chris Nanos told reporters the department is not letting go: “This one’s far from being cold, and we’ll continue to work it.” He also said he believes an arrest will eventually come. For a family that has spent half a year in limbo, those words and these letters are the newest push to finally get an answer.
