An extortion email includes your password: what to do

Some extortion emails include a known password and threaten to publish intimate images or delete files. They want the victim to pay before checking whether the threat has any basis.

After a leak, email addresses and, in some cases, passwords or their hashes can be exposed. That data can later be reused in mass extortion campaigns.

The fact that the message includes a known password does not by itself prove that the device or account is currently compromised. It does prove that the combination should not be used any longer or reused on other services.

Do not reply, do not pay and do not open links or attachments. If the password is still in use or was reused, change it on every affected service, use unique passwords and enable 2FA.

If you also notice access, sessions, email rules or changes you do not recognise, keep the message and request a review of the activity. The extortion text does not prove access, but it should not be used to dismiss independent evidence either.

There is also a particularly useful service, haveibeenpwned, where you can enter your email to check whether it was exposed in any hack of the platforms and services that have documented attacks in recent years.

A result with no known leaks on Have I Been Pwned does not prove an account is safe either: the service only reports the data it knows about. Do not enter a current password in links sent by whoever is threatening you.

If you have already paid or the threats come with independent evidence, keep the conversation and ask for help through official channels. INCIBE documents these sextortion campaigns. You do not need to reply to the extortionist to check the activity on your accounts.