-
The FBI says an 18-year-old swatted a girl’s home for years and threatened to firebomb it.
-
Agents say his VPN failed because the chat account was registered to his own phone number.
-
He has pleaded not guilty. No court has tested these claims.
A VPN did not hide an 18-year-old from the FBI, according to a federal court filing. Agents say Brandon Kapfhammer targeted a girl’s family in Pennsylvania for years. He is accused of making false 911 calls to her home and threatening to blow it up.
Swatting refers to making a false call to the emergency services to dispatch armed officers to someone’s home. He has denied the charges, meaning that the prosecution must provide proof against him.
Case Details as Revealed in the Court Filing
Matthew Cerrillo of the FBI swore to the affidavit on July 10, 2026. The affidavit supports two charges under federal law: cyberstalking and interstate threats. Court papers also list Kapfhammer as Brandon Hiser.
The girl resides in Delaware County, Pennsylvania. The affidavit states that they met online in 2023 when she was around 12 years old and he was 15 years old. They met through the Com, a loose online network. The affidavit says its members commit crimes such as swatting, crypto theft, and violence.
At first, the two were friends. Soon, the affidavit says, he used threats to control her. If she refused his demands, he vowed to swat her home and throw bricks through its windows.
When she refused, the filing says, he followed through. Police reports show more than 30 false emergency calls to the home since 2023. She estimates he swatted it at least 20 times. Bricks also hit the home at least three times. In August 2024, one brick smashed a television. The affidavit says he paid a local person to do it, and that he admitted this to her online.
Meanwhile, other fake calls used her name to threaten nearby schools. The filing admits one weakness. The girl sometimes shared details late and played down her ties to the Com. Even so, the agent says other evidence backs the key facts.
The Threats Against the Victim
On May 10, someone firebombed her brother’s car in the family driveway. A tipster gave investigators a video. It shows two people smashing a window and tossing an object inside. Flames spread as they ran. A federal arson investigator called the fire intentional. The filing does not name the two people.
Two weeks later, the threats grew. On May 26, a user named “bdog” messaged the girl on a chat app. Agents say “bdog” was Kapfhammer. The filing calls the app “Platform A,” but news reports say it was Discord.
In that chat, he allegedly said every school in Pennsylvania would shut down under her name. He also wrote that “the moli comes through our window.” Agents read that as a Molotov cocktail threat. Then he said he would delete the account “so I don’t rot in prison” if a family member died in a fire.
The Attacker’s VPN Failed to Hide His Tracks
A VPN hides a person’s internet address. Agents say it did not hide this account. App records showed “bdog” was registered with a Verizon phone number. The logs showed both cell data and VPN use. VPN services also face broader security risks, with ransomware groups increasingly targeting VPN infrastructure as part of their attack strategies.
Switching between the two leaves gaps. When “bdog” used plain cell data, six logins matched addresses Verizon gave that phone, often within minutes.
Verizon listed the subscriber as “Brandon Withers.” Apple records tied the number to an iCloud account under the same name. The filing does not explain how that name links to Kapfhammer and Hiser. It relies on the evidence below.
Agents Cite More Evidence Against the Suspect
A second girl told agents that Kapfhammer swatted her home several times. She said he used that same number to reach her and her parents. Verizon records showed a call from it to her father’s phone.
Cell tower data placed the phone in Louisville, Kentucky, from May 2 to June 9. Agents say that fits where he lived. Fake calls also hit a Louisville home tied to his family.
Callers mentioned him by name. On May 15, one caller claimed his brother had shot him. As a result, officers held the man living there at gunpoint. Agents believe he is Kapfhammer’s uncle.
Finally, on July 2, agents searched trash outside a Louisville home linked to the Apple account’s logins. It held food packaging labeled “Brandon W.”
What Comes Next
Agents wrote the affidavit to get an arrest warrant. The case is No. 2:26-cr-00407 in the Eastern District of Pennsylvania. The not-guilty plea comes from published reports, not from the complaint.
An affidavit only has to show probable cause. That bar is lower than the proof needed at trial.
Some alleged acts happened while he was a minor. However, he turned 18 in March 2026, and the filing says the threats continued. The affidavit cites an appeals court ruling to argue that adult charges fit such cases.
In a separate case earlier this year, federal prosecutors in Philadelphia called swatting increasingly common. They said they will pursue these cases no matter who makes the calls.
