Cybercriminals are exploiting email addresses exposed in previous ShinyHunters data leaks to conduct a new sextortion campaign demanding $2,000 in Bitcoin. The fraudulent messages falsely claim that ShinyHunters compromised victims’ phones and computers, accessed their cameras and microphones, and recorded them visiting adult websites. However, the campaign appears to involve unrelated scammers who downloaded previously leaked information and are using it to make their threats appear credible.
The emails reportedly use random sender addresses and names such as “ShinyHunters” or “You’ve Been HACKED.” Their subject line commonly reads “Information about your online security.” In the messages, attackers mention companies whose databases were previously exposed, including Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill. By identifying a company connected to the recipient’s email address, scammers attempt to create the impression that they specifically targeted the victim.
The scam messages claim that attackers installed malware capable of accessing a victim’s microphone, camera, keyboard, photographs, browsing history, conversations, and contact list. They then threaten to send allegedly recorded intimate videos to the recipient’s family, friends, colleagues, and business contacts unless payment is made within 48 hours. The emails also instruct recipients not to contact law enforcement, reply, or reset their devices, claiming that stolen data is stored on remote servers. These warnings are intimidation tactics rather than evidence of a genuine device compromise.
According to the report, the campaign may have begun in April, with victims and organizations sharing similar warnings online. Betterment acknowledged that some customers received threatening emails and described them as a common extortion scam. The company emphasized that knowing someone’s email address does not give criminals the ability to install malware or access that person’s device. It advised recipients not to reply, pay, click links, or open attachments, while asking anyone who interacted with the message to contact its fraud team.
People receiving these emails should remain calm and avoid paying the Bitcoin demand, because payment does not guarantee that scammers will stop contacting them. Recipients should preserve the message as evidence, report it to their email provider and relevant cybercrime authorities, then delete it after checking for suspicious account activity. They should also use unique passwords, enable multifactor authentication, update devices, and monitor accounts associated with the exposed email address. The campaign demonstrates how data stolen in one breach can later be reused by unrelated criminals to support convincing but false threats.
