Cybersecurity professionals and privacy-conscious users should be aware of a burgeoning sextortion campaign that exploits email addresses previously exposed in data breaches attributed to the **ShinyHunters** extortion group. These emails demand a ransom of $2,000 in Bitcoin, threatening to release fabricated compromising material. ### The Modus Operandi The emails arrive from various sender addresses, often using names like "ShinyHunters" or "You've Been HACKED," with the subject line "Information about your online security." The core of the scam is a claim that the sender, purporting to be **ShinyHunters**, gained access to the recipient's devices months prior after obtaining their email from a breached company database. Crucially, **BleepingComputer** has observed this campaign leveraging leaked data from prominent breaches affecting companies such as **Amtrak**, **Hallmark**, **Substack**, **Betterment**, **CarGurus**, **ADT**, **Panera Bread**, and **McGraw Hill**. For some recipients, it was confirmed that their email addresses were indeed part of the associated **ShinyHunters** data leaks, lending a deceptive air of legitimacy to the threats. ### Dissecting the False Claims One email reviewed by **BleepingComputer** stated: "We are the ShinyHunters hacking group. A few months ago, we gained access to your devices and started monitoring your online activities. What happened: We gained access to the Cargurus.com database where you have an account and easily accessed your email. You weren't very careful about the links you opened. A week later, we installed an exploit on your devices, including your phone, giving us access to your microphone, camera, keyboard, and all your data. We have your photos, browsing history, conversations, and contact list."  **Sextortion email claiming to be from the ShinyHunters extortion group** *Source: BleepingComputer* The messages falsely claim that an exploit was installed on the victim's devices, granting access to microphones, cameras, keyboards, photos, browsing history, conversations, and contact lists. The primary threat is the alleged recording of the recipient visiting adult websites, with a demand to send $2,000 in Bitcoin within 48 hours to prevent these videos from being shared with friends, colleagues, and family. The emails also typically warn against contacting law enforcement, replying to the message, or attempting to reset devices, asserting that the stolen information is stored on remote servers. ### Separating Fact from Fiction Despite the alarming nature of these claims, there is no evidence that the senders have actually compromised recipients' devices, installed malware, accessed cameras, or monitored online activity. The **ShinyHunters** group itself has denied any involvement in this sextortion campaign when contacted by **BleepingComputer**. This campaign is a classic example of a sextortion scam, designed to induce panic and coerce payments based on fear of reputational damage. The attackers' tactic is to leverage publicly available leaked email addresses and associated breach details to make the threats appear highly targeted and credible. While these scams may seem unsophisticated, similar campaigns have proven highly profitable in the past, generating significant sums for threat actors. The current wave of emails began in April, with numerous reports surfacing across platforms like Reddit and various organizational warnings. ### Advice for Individuals and Organizations **Betterment**, one of the companies whose data was referenced in these emails, has issued a public statement acknowledging that some clients received threatening emails. They clarified, "Please note, knowing an email address does not provide the ability to install malware or access someone's device." Security professionals and privacy-conscious users are strongly advised: * **Do not pay the ransom.** * **Do not reply to the sender.** * **Do not click on any links or open attachments within these emails.** * **Delete the email immediately.** Even if your email address was part of a referenced data leak, this does not validate the sender's claims of device compromise or access to personal data. Organizations should educate their employees and customers on how to identify and respond to such phishing and extortion attempts, emphasizing that paying the ransom only encourages further malicious activity.