Updated Jan 23rd 2019 to include latest variations on this scam.
You may have arrived at this post because you received an email from a purported hacker who is demanding payment or else they will send compromising information—such as pictures sexual in nature—to all your friends and family. You’re searching for what to do in this frightening situation.
Don’t panic. Contrary to the claims in your email, you haven’t been hacked (or at least, that’s not what prompted that email). This is merely a new variation on an old scam which is popularly being called “sextortion.” This is a type of online phishing that is targeting people around the world and preying on digital-age fears.
DOnate to help EFF defend privacy and free expression
We’ll talk about a few steps to take to protect yourself, but the first and foremost piece of advice we have: do not pay the ransom.
We have pasted a few examples of these emails at the bottom of this post. The general gist is that a hacker claims to have compromised your computer and says they will release embarrassing information—such as images of you captured through your web camera or your pornographic browsing history—to your friends, family, and co-workers. The hacker promises to go away if you send them thousands of dollars, usually with bitcoin.
What makes the email especially alarming is that, to prove their authenticity, they begin the emails showing you a password you once used or currently use.
Again, this still doesn’t mean you’ve been hacked. The scammers in this case likely matched up a database of emails and stolen passwords and sent this scam out to potentially millions of people, hoping that enough of them would be worried enough and pay out that the scam would become profitable.
EFF researched some of the bitcoin wallets being used by the scammers. Of the five wallets we looked at only one had received any bitcoin, in total about 0.5 bitcoin or $4,000 at the time of this writing. It’s hard to say how much the scammers have received in total at this point since they appear to be using different bitcoin addresses for each attack, but it’s clear that at least some people are already falling for this scam.
Here are some quick answers to the questions many people ask after receiving these emails.
They have my password! How did they get my password?
Unfortunately, in the modern age, data breaches are common and massive sets of passwords make their way to the criminal corners of the Internet. Scammers likely obtained such a list for the express purpose of including a kernel of truth in an otherwise boilerplate mass email.
If the password emailed to you is one that you still use, in any context whatsoever, STOP USING IT and change it NOW! And regardless of whether or not you still use that password it’s always a good idea to use a password manager.
And of course, you should always change your password when you’re alerted that your information has…