<\/p>\n
Wayne P. of Evangeline, Louisiana, opened an email<\/a> that would make almost anyone’s stomach drop. The sender claimed to represent the ShinyHunters hacking group and demanded $2,000 in Litecoin within 48 hours. The message also claimed hackers had recorded intimate videos through Wayne’s camera and planned to send them to his contacts.<\/p>\n Wayne paused instead of paying. He ran security scans<\/a> on his phone and PC, then contacted CyberGuy.<\/p>\n Wayne’s instincts were right. The email closely matches a widespread sextortion campaign<\/a> that uses real breach information to support an invented device takeover. So, what gave this scam away, and what should you do if a threat like this lands in your inbox?<\/p>\n AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS<\/strong><\/a><\/p>\n CyberGuy Live: Missed “Sick of Spam?” Get the replay and checklist<\/strong><\/p>\n Our free CyberGuy Live class, “Sick of Spam?”<\/strong>, has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt “CyberGuy” Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You\u2019ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.<\/p>\n Get the free replay and checklist <\/strong>now at CyberGuyLive.com<\/u><\/strong>.<\/p>\n Wayne’s email follows a familiar sextortion script. The sender claims hackers reached his phone and computer, then says they recorded intimate activity through his camera. However, the message offers no proof. Wayne received no screenshot, stolen file or sample of the supposed recording. The demand for $2,000 in Litecoin, the 48-hour deadline and the warning against contacting police all point to an extortion scam built to create panic.<\/p>\n The FBI has warned that emails signed with the ShinyHunters name may contain false claims about embarrassing photos or videos. In many cases, the material described in the message never existed. CyberGuy has covered similar sextortion emails that use personal details and Google Maps images<\/u><\/a> to make a bluff feel disturbingly personal.<\/p>\n The scam contains one accurate detail. Carnival Corporation disclosed a data breach after an April 2026 social engineering attack. Carnival said its security team found unauthorized activity involving an employee account on April 14. The company blocked the activity and brought in outside security experts. On April 22, investigators determined that the attacker had copied personal information. The exposed data varied by person. Carnival listed names, home addresses, email addresses, phone numbers, birth dates and government-issued identification numbers. The company began sending notices on May 27. It also offered eligible people in the U.S. two years of complimentary credit monitoring.<\/p>\n CyberGuy previously explained how the Carnival breach may put your travel data at risk<\/u><\/a>. Our report noted that nearly 6 million people may face phishing or identity theft risks after the breach. A scammer may know that you used Carnival or Holland America because your information appeared in leaked data. However, an email address alone gives the sender no control over your phone, camera, microphone or keyboard. The breach supplies the believable detail. The scammer invents the rest.<\/p>\n CyberGuy reached out to Carnival for comment, and a Carnival Corporation spokesperson provided us with the following statement:<\/p>\n “In April, we identified unauthorized access to a limited part of our IT system caused by a social engineering attack on a single user account. We immediately blocked the activity, engaged third-party security experts and alerted law enforcement. Our investigation found certain personal information was illegally accessed. We’re notifying affected individuals and deeply regret any concern this causes. Protecting the privacy<\/a> and security of personal data is a priority for us and we’ve added new layers of security and monitoring on top of the comprehensive protections already in place. We’ll also continue advancing our defenses against evolving threats.”<\/p>\n Wayne’s message contains several signs of a bluff. First, it came from an unrelated address. The sender offered no screenshot, stolen file or other evidence of access. Meanwhile, the message demanded cryptocurrency and imposed a 48-hour deadline. It warned Wayne against contacting police and told him not to reset his devices. Those instructions create panic while discouraging outside advice.<\/p>\n The sender also promised to remove Wayne’s information from the dark web after payment. The email provides no way to verify that claim. Paying could also confirm that the address reaches someone willing to respond. The FTC warns that blackmail emails<\/a> may claim access to a computer or webcam. Some messages include information exposed in a data breach to make the story sound credible. The agency advises recipients to avoid payment.<\/p>\n COULD THE 7-ELEVEN BREACH AFFECT YOU?<\/strong><\/a><\/p>\n Wayne’s clean scans support the conclusion that the email contains an empty threat. Still, no single scan can evaluate every online account tied to an email address. Based on the message alone, Wayne has no reason to erase or factory-reset his devices. The situation changes if he clicked a link, opened an attachment or installed software.<\/p>\n Therefore, the next step involves checking accounts rather than wiping devices. Review the recent sign-in history for your email account. Then inspect forwarding settings and inbox rules for anything unfamiliar. A criminal with email access may create a rule that secretly sends copies of your messages elsewhere.<\/p>\n A fake threat still deserves a calm security check. These steps can help you close possible openings and prepare for follow-up scams.<\/p>\n Do not send cryptocurrency. Avoid replying to the email as well. A response confirms that someone reads the address. It may encourage the scammer to increase the pressure or send another demand.<\/p>\n Wayne did the right thing by forwarding the message to reportphishing@apwg.org<\/strong>. The Anti-Phishing Working Group accepts suspicious emails for analysis and archiving. When your email service allows it, forward the original message as an attachment. That method preserves more technical information. You can also report the message through the FTC’s ReportFraud website at reportfraud.ftc.gov\/ and the FBI’s Internet Crime Complaint Center at ic3.gov\/. IC3 accepts reports involving cyber-enabled fraud, online scams and other internet crimes. After reporting it, mark the email as phishing or spam. Then delete it.<\/p>\n Carnival’s public notice omits account passwords from its list of exposed information. Even so, change your Carnival or Holland America password if you reused it somewhere else. Your email account deserves extra attention because password reset messages often land there. Use a long, unique password and turn on two-factor authentication. A trusted password manager<\/u><\/a> can create and store unique passwords. That prevents one exposed password from unlocking several accounts.<\/p>\n Open your email provider’s security page and review recent logins. Look for devices or locations that you do not recognize. Check the dates and times as well. Next, check automatic forwarding and inbox rules. Remove anything unfamiliar. Then change the password and sign out of other sessions.<\/p>\n WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME<\/strong><\/a><\/p>\n