Got a threatening email that knows your address and demands Bitcoin? Here's why it's empty

An email lands. It already knows your address, it drops the name of a real hacking group, and it claims there's an embarrassing webcam recording of you that'll go public unless you pay. It's designed to make your stomach drop - and it's completely hollow.

Researchers at BleepingComputer and Malwarebytes have been tracking a sextortion campaign, running since around April 2026, that leans on data leaked by the extortion crew ShinyHunters. The scammers pulled email addresses from past breaches - the leaked data traces to companies like Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread and McGraw Hill - and use your real address, and sometimes the name of a company you actually had an account with, to sound convincing. The demand is oddly specific: $2,000 in Bitcoin within 48 hours. Notably, ShinyHunters itself denied being behind these emails; it's other criminals cashing in on the group's name.

Here's the part that matters: there is no malware, no camera access, and no recording. Knowing your email address gives someone exactly zero ability to have hacked your PC or filmed you - the Bitcoin wallets in these messages typically show no payments at all. So don't reply (that just confirms a live address), don't pay, and don't treat any attached "proof" as real. Delete it and mark it as spam. If the email quotes an actual password of yours, that's a sign it leaked somewhere old - change it wherever you used it and switch on two-factor authentication.

The whole trick runs on a leaked email address feeling like a break-in. Tendvane's Privacy & accounts check shows which of your logins have turned up in known data leaks, so when a stranger recites your details you know exactly where they came from - and that it doesn't mean anyone touched your computer.