In short
Extortion emails threaten to publish videos, photos or data unless you pay, usually in cryptocurrency. They are almost always a mass scam: the password they show comes from an old data breach, and the email looks like it was sent from your own account thanks to sender spoofing. There's no need to pay or reply, but you should change that password wherever it's still in use.
What an extortion email looks like
- It claims your computer or camera was hacked and that they have compromising videos or photos.
- To look credible, it shows a password you once used.
- Sometimes it appears to have been sent from your own email address.
- It demands payment in Bitcoin or another cryptocurrency with a short deadline, such as 48 hours.
Why it's almost always fake
- The password comes from a data breach. When a site suffers a data breach, lists of emails and passwords circulate online. The attacker just matches them up.
- The sender is spoofed. Putting your address as the sender doesn't require access to your account, just like anyone can write any return address on an envelope. SPF, DKIM and DMARC exist precisely to catch that.
- It's a mass mailing. The same text reaches thousands of people; only the email and password change.
What to do and what not to do
- Don't pay. Paying guarantees nothing and marks you as someone who pays.
- Don't reply, so you don't confirm the address is active.
- Change the password shown in the email everywhere you use it, and turn on two-factor authentication.
- Check whether your email appears in known breaches with services like Have I Been Pwned.
- If the threat includes real, specific information, or involves minors, file a report with the PDI (Cybercrime Investigation Unit).
How to reduce it on your server
- Set up DMARC on your domains so emails spoofing your address get rejected or sent to spam.
- Use a filter that recognizes these campaigns. Clisec recognizes the blackmail and threat patterns typical of extortion emails.
Frequently asked questions
How do they have my password if I wasn't hacked?
It almost always comes from a breach at some site where you registered with that email. That's why it's best not to reuse passwords.
Why does the email look like it came from my own account?
Because an email's sender can be spoofed. If your domain has DMARC with a strict policy, servers that honor it reject those messages.
Should I pay if the deadline is about to expire?
No. The threats in these mass campaigns are never carried out, and paying only exposes you to more attempts.
Protect every account on your server
Clisec recognizes the blackmail and threat patterns typical of these campaigns before they reach any account on your cPanel server.