How can you recognize Sextortion Scammers Exploit ShinyHunters Data Leaks to Demand Bitcoin Payments?

Listen to the episode

TLDR

Sextortion scammers are impersonating the ShinyHunters hacking group, using email addresses harvested from recent data breaches (Amtrak, Hallmark, ADT, Substack, and others) to send fake blackmail emails demanding $2,000 in Bitcoin. The...

How it works

Red flags

Unsolicited email claiming a hack or recording with no real proof attached Bitcoin payment demand paired with a tight 48 hour deadline designed to cause panic Reference to a specific recent breach (Amtrak, Canvas, etc.) used only to look legitimate

What to do

1Do not reply, pay, or click any links
2delete the email and report it as phishing Change any password mentioned in the message and turn on two factor authentication Run a reputable antivirus scan and consider monitoring accounts for suspicious activity

Source

malwarebytes

Source reviewed by Mythos Forensic Team

https://www.malwarebytes.com/blog/scams/2026/07/sextortion-scammers-are-exploiting-shinyhunters-data-leaks

FAQ

Is Sextortion Scammers Exploit ShinyHunters Data Leaks to Demand Bitcoin Payments a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Unsolicited email claiming a hack or recording with no real proof attached Bitcoin payment demand paired with a tight 48 hour deadline designed to cause panic Reference to a specific recent breach (Amtrak, Canvas, etc.) used only to look legitimate

What should I do first?

Do not reply, pay, or click any links; delete the email and report it as phishing Change any password mentioned in the message and turn on two factor authentication Run a reputable antivirus scan and consider monitoring accounts for suspicious activity

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.