Got a ‘ShinyHunters’ Sextortion Email? It’s a Bluff. Here’s Proof.

Is the ShinyHunters sextortion email real?

The ShinyHunters sextortion email is not real, and the threat inside it is empty. The message claims a hacking group accessed your devices months ago, recorded you through your webcam, and will release the video unless you send $2,000 in Bitcoin within 48 hours. None of that happened.

What is real is narrow and harmless on its own: the scammer knows one of your email addresses. That address was exposed in a past company data breach, and the scammer downloaded the leaked list, as BleepingComputer documented. Knowing an email address does not give anyone the ability to install malware or reach your camera, files, or messages. The email trades entirely on fear, not on any actual access.

The real ShinyHunters extortion group, which was not involved, denied any connection to the campaign when contacted by researchers. The people sending these emails simply borrowed a name that has been in the news to make an old bluff feel current.

How do the scammers know your email address?

The scammers know your email address because it appeared in a data breach, and nothing more than that. Companies get breached, customer email lists leak, and those lists circulate. Your address was on one of them.

Researchers have seen this campaign use addresses drawn from breaches at several well-known companies, including Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill. If you did business with any of those, your address may well be in the batch being targeted. That is the entire basis of the “hack.” There was no break-in to your accounts, only a leak from a company that held your address.

You can check which breaches your address has appeared in, which often explains exactly where the scammer got it. Our guide on how to check whether your email has been in a data breach walks through the process. A recent example of how these lists escape is the Suno data breach, where tens of millions of addresses were exposed and only surfaced publicly months later.

What does the scam email actually say?

The email follows a script, and recognising the script is the fastest way to dismiss it. It typically arrives from a random address using a name like “ShinyHunters” or “You’ve Been HACKED,” with a subject line along the lines of “Information about your online security.”

The body makes escalating claims designed to frighten rather than to prove anything:

• It says attackers accessed your devices several months ago
• It names a company whose data was leaked, to make the access seem real
• It claims an installed exploit gave access to your camera, microphone, files, and contacts
• It says you were recorded on adult websites and threatens to send the video to your family and colleagues
• It demands about $2,000 in Bitcoin within 48 hours
• It warns you not to contact police or reset your devices

That last instruction is the tell. A message that tries to stop you from involving the police or securing your own device is protecting the scammer, not describing a real hack. There is no evidence behind any of it, and checks of the Bitcoin addresses used in this campaign have shown no payments received.

Here is each claim in the email set against what is actually true:

What should you do if you get one?

Safety first: this is a bluff, and the safest response is to not engage at all. Unlike a real account compromise, there is nothing to contain here, because no one has access to anything. The steps below are about closing the door the leak left open, not about repelling an active intruder.

1. Do not pay. There is no video and no recording. Paying funds the scam and marks your address as one that responds, which invites more attempts.
2. Do not reply, click, or open attachments. Replying confirms your address is active. Links and attachments are the one way a harmless email could become a real threat.
3. Do not panic over the details. A named company, a real-looking address, or polished wording proves only that the scammer read a breach list and, increasingly, used AI to write cleaner text.
4. Change the password on the breached account, and on any other account where you reused that password. This is the one genuinely useful action, because a leaked address often travels with a leaked password.
5. Turn on two-factor authentication, starting with your email account, so a leaked password alone cannot open it.
6. Delete the email and report it as spam so your provider filters similar messages.

If the message named a real password you still use anywhere, treat that as the priority and change it everywhere immediately, because that detail points to a reused credential rather than a device hack.

What if the email contains a real password?

Some sextortion emails quote a real password to seem convincing, and this is the one variant that needs a genuine response. The password did not come from your device. It came from a breach that exposed passwords alongside addresses, and the scammer is betting you still use it.

Change that password immediately, everywhere you use it. Then stop reusing passwords across sites, because a single leaked one is what makes this trick work. A password manager makes unique passwords practical, and our guide to data privacy management tools covers options for keeping track of what you have exposed across services.

The threat in the email is still a bluff even when the password is real. A leaked password proves a company was breached, not that anyone is inside your computer. Fix the password, ignore the rest.

Could your device actually be infected?

The email cannot tell you that, because it is sent blind to millions of addresses with no knowledge of any recipient’s device. But if you are worried independently of this scam, checking is reasonable and simple.

Run a scan with reputable security software to put the question to rest. Our roundups of the best free antivirus for Windows 11 and how to remove malware from Windows 11 for free cover trustworthy tools. If your specific worry is webcam access, some security software can alert you when an app tries to use the camera, and a piece of tape over the lens is a zero-cost measure many people take anyway.

Stop here and consult a professional if a scan finds something you cannot remove, or if you see genuine signs of compromise such as accounts logging in from unfamiliar locations. For phones specifically, our guide to detecting and removing phone spyware is the right starting point. None of that is prompted by the sextortion email itself, which remains an empty threat.

Why are these scams getting more convincing?

Two things have made a years-old scam feel fresh in 2026, and knowing them helps you stay calm when one lands.

The first is the steady supply of breached data. Large leaks now happen often enough that most people’s addresses are in at least one, so the scammer can reference a real company and a real address with almost no effort. The second is AI-assisted writing. Older sextortion emails were riddled with errors that gave them away. Many now read cleanly, which removes one of the easy tells, so polish is no longer evidence that a threat is real, as Malwarebytes notes.

Neither change alters the underlying reality. The scam still depends on the recipient supplying the fear, because the sender supplies no actual access. Treat every version the same way regardless of how professional it looks, and consider whether your everyday privacy habits limit how much of your data is out there to begin with. Our overview of cybersecurity and data privacy covers the basics worth having in place.

FAQ

Can someone hack me just by knowing my email address?

No, because an email address alone cannot give anyone access to your device, camera, files, or accounts. A sextortion email that knows your address has only read a leaked breach list, not broken into anything.

Should I pay the ShinyHunters sextortion demand?

No, because there is no video or recording behind the threat, so there is nothing to pay for. Paying also flags your address as one that responds, which typically brings more demands, so delete the email and report it as spam instead.

How did the scammer get my email address?

From a past company data breach: this campaign has used addresses leaked from firms including Amtrak, Panera Bread, and Substack. The scammer downloaded that list and is emailing everyone on it, which is why the message can name a real company without ever having accessed your device.

The email included my real password. Am I hacked?

Not through your device, but you should still act, because the password came from a breach that exposed credentials rather than from your computer. Change that password everywhere you use it right away and stop reusing it, though the threat in the email itself remains a bluff.

Should I report the sextortion email to anyone?

Reporting it as spam to your email provider is worthwhile and helps filter similar messages. In the US, you can also report sextortion attempts to the FBI’s Internet Crime Complaint Center at ic3.gov, and you never need to reply to the scammer.