2021 Pappy Van Winkle Heist: Unsealed search warrant reveals details of investigation into stolen high-dollar bourbon

UPDATE: The Lexington Times received a statement from the subject of the search warrant published in this article: “The bottles I had in my possession were purchased at a store legally, and that was proven to the agencies with receipts.” No charges have been filed in the case in the Eastern District of Kentucky, as of May 2023. We have removed the individual’s name at their request.

Frankfort, Ky.–On November 23, 2021, a large order of high value bourbon was shipped from Buffalo Trace Distillery in Frankfort, Kentucky to Breakthru Beverage in Cicero, Illinois. 21 bottles of 12-year Pappy Van Winkle bourbon were discovered missing from the shipment when it arrived in Illinois. The distillery incurred a relatively small loss from the stolen bottles, but each bottle could potentially be sold on the secondary market for approximately $800- $1000. A short time later, an individual in Hobart, Indiana, about an hour’s drive away from Cicero, listed “a large amount of high value bourbon, including 21 bottles of 12 year Pappy Van Winkle bourbon,” for sale on Facebook and Instagram for $120,000, according to a 2022 federal search warrant application that was unsealed in the Eastern District of Kentucky this week. The newly revealed warrant application sheds new light on the details of the investigation.

An excerpt of the search warrant application is below.

by Simon Butler, Special Agent, FBI

PROBABLE CAUSE

In February 2022, the FBI opened a case following a complaint from Sazerac Incorporated, owner of Buffalo Trace distillery in Frankfort, Kentucky, regarding [NAME REDACTED]. The complaint alleged that [NAME REDACTED] attempted to sell high value bourbon on Facebook and Instagram some of which was potentially stolen from a bourbon shipment between Buffalo Trace Distillery in Frankfort, Kentucky and whiskey broker Breakthru Beverage in Cicero, Illinois.

On November 23, 2021, a large order of high value bourbon was shipped from Buffalo Trace Distillery in Frankfort, Kentucky to Breakthru Beverage in Cicero, Illinois. 21 bottles of 12 year Pappy Van Winkle bourbon were discovered missing from the shipment when it arrived at Breakthru Beverage in Cicero, Illinois. Sazerac incurred a loss of approximately $1,029.91 from the 21 stolen bottles of bourbon but each bottle could potentially be sold on the secondary market for approximately $800- $1000.

On December 8, 2021, a concerned bourbon enthusiast reported an individual who was attempting to sell a large amount of high value bourbon, including 21 bottles of 12 year Pappy Van Winkle bourbon, on Facebook and Instagram for $120K. Sazerac hired a third-party investigator to look into the matter. The third-party investigator, a retired FBI Agent, determined the Facebook user selling the high value bourbon’s true name was [NAME REDACTED] and lived in Hobart, Indiana. The third-party investigator provided the FBI with the user’s Facebook account URL and screen shots reflecting posted photographs (Fig.1) related to the alleged stolen bourbon sale on Facebook. The screen shots provided to the FBI by the third-party investigator also showed interested buyers commenting on the photos and discussing prices of the sale with [NAME REDACTED] (Fig. 2).

Based on the information provided by this private investigator, the FBI submitted legal process to Facebook for subscriber information and IP activity associated with Facebook user ID number [REDACTED] (hereinafter, “Subject Account”). The information provided by Facebook in response confirmed the Subject Account was registered to [NAME REDACTED] of Hobart, IN.

The photographs of [NAME REDACTED]’s Facebook post on December 8, 2021, provided to the FBI by the third-party investigator, included photographs depicting Buffalo Trace Distillery shipping boxes with some of the labels visible (Fig. 3). The bottle Lot numbers were also visible on some of the labels. Those Lot numbers were matched with the Lot numbers of bottles sent to Breakthru Beverage on November 22, 2021. Although the stolen bourbon was sent to Breakthru Beverage in a separate shipment on November 23, 2021, the Lot numbers suggest [NAME REDACTED] was associated with Breakthru Beverage and potentially acquired at least part of the bourbon in the photographs from a shipment to that company. The bourbon bottles from the November 22, 2021, shipment were not reported stolen but in my training and experience criminals are known to comingle illegally acquired products with legally acquired products in an attempt to thwart detection by law enforcement during resale.

The information provided by Facebook in response to legal process also included IP addresses reflecting activity associated with Subject Account. This IP activity showed access to the Subject Account from multiple locations within 10 miles of Breakthru Beverage in Cicero, IL. The majority of the IP addresses used to log onto Subject Account came back to the Chicago metropolitan area.

On August 31, 2022, the FBI submitted legal process to JPMorgan Chase bank for records relating to [NAME REDACTED]. Financial documents obtained from JPMorgan Chase bank showed [NAME REDACTED]’s bank account received a $110K payment from an individual on December 10, 2021 with “Pappy” in the reference line. On December 13, 2021, [NAME REDACTED] received an additional $18,600 payment from a business owned by the same individual.

On August 23, 2022, the FBI submitted legal process to Facebook for all records not to include content of communications associated with Subject Account. Those records showed [NAME REDACTED] was in communication with a group of four other individuals. The group’s Facebook message activity spiked around the time of the bourbon shipment and the suspected secondary market bourbon sale (Fig. 4).

On April 1, 2022, the FBI sent Facebook a request to preserve the content of Subject Account pursuant to 18 U.S.C. § 2703(f).