ShinyHunters data leaks fuel sextortion scams
Scammers are sending fake blackmail emails claiming they hacked your webcam and recorded you visiting adult sites. They use real email addresses stolen from past ShinyHunters data breaches to make the threat look convincing, then demand payment.
- Report priority
- High
- Victim
- ShinyHunters data leaks fuel sextortion scams
What is known
Attackers pull email addresses out of data previously stolen and leaked by the ShinyHunters extortion group, then send a mass email to those addresses pretending it comes from ShinyHunters, claiming it planted spyware on the recipient's camera and microphone.
What to do
Check whether your email address appears in any of the breaches tied to Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, or McGraw Hill, or whether you received an email demanding Bitcoin over an alleged recording.
Do not pay, reply, click links, or open attachments in these emails. Simply having your email address does not let anyone install malware or access your camera, so delete or report the message and change passwords on any breached accounts as a precaution.
Reported details
A person's email address turns up in data ShinyHunters leaked from a breached company such as Amtrak, Hallmark, or Panera Bread. They receive an email claiming their devices are hacked and recorded on adult sites, telling them not to contact police or reset the device. The message demands 2,000 dollars in Bitcoin within 48 hours or the recording gets sent to their contacts. No hacking or recording ever happened, the attacker only had the leaked email address.
The campaign is a mass phishing run, not a technical exploit. Operators scrape email addresses from data dumps ShinyHunters previously published from breaches at companies including Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill. They send templated sextortion emails impersonating ShinyHunters, falsely claiming device compromise and webcam recording, and demand 2,000 dollars in Bitcoin within 48 hours. There is no evidence of actual malware, camera access, or recording; the emails rely purely on the recipient recognizing their own leaked email address as proof of compromise.