The plot was initially flagged by American intelligence, leading to the arrest of 19-year-old Austrian citizen of Macedonian descent, identified as the main suspect. Authorities discovered weapons, explosives materials, counterfeit currency, and Islamic State-related propaganda during raids at his residence in Ternitz, located approximately 40 miles from Vienna. Although he remains imprisoned, another accomplice arrested in August has since been released without charges.

The investigation revealed that the Syrian teenager became radicalized through online platforms and had facilitated a connection between the main suspect and an Islamic State affiliate via social media platforms. As he is still a minor, the Syrian has not been taken into custody. The cancellation of Swift's concerts was a significant economic setback for Vienna, as her events typically bring substantial financial benefits to local economies.