Sextortion Scam Uses Email Addresses From ShinyHunters-Linked Data Leaks
Summary
A sextortion campaign uses email addresses from prior ShinyHunters-linked data leaks to demand $2,000 in Bitcoin. The device-compromise claims appear false; ShinyHunters denied involvement, and Betterment advised recipients not to pay or reply.
Key points
- The campaign, reported to have started in April, uses addresses exposed in data leaks linked to Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill.
- Emails impersonate ShinyHunters and demand $2,000 in Bitcoin, threatening to expose alleged intimate videos.
- BleepingComputer confirmed that some targeted email addresses appeared in the associated previously leaked data.
- There is no indication the sender accessed recipients’ devices, installed malware, accessed cameras, or monitored their activity.
- ShinyHunters denied involvement; Betterment described the messages as a common extortion scam.
- Recipients are advised not to pay or reply; Betterment also advised against clicking links or opening attachments.
Article Details
- Event Type
- Sextortion email scam impersonating ShinyHunters and reusing email addresses from data breaches previously linked to the group.
- Impact
- Recipients are threatened with public release of fabricated intimate videos and asked to pay $2,000 in Bitcoin. The article reports no evidence that the sender compromised recipients’ devices, installed malware, accessed cameras, or monitored their activity. The article says the campaign appears to be run by someone reusing leaked data, and ShinyHunters denied involvement.