What to do if you receive an extortion email
Most extortion emails are bluffs sent to thousands of people. Some are not. Here is how to tell the difference without engaging the sender, and what to do in each case.
Reviewed by the ITRS security team · Last updated
Bluff or genuine?
| Usually a bluff | Possibly genuine |
|---|---|
Claims your webcam recorded you, or that they 'hacked your device' | Names your organization and refers to a specific intrusion |
Quotes an old password (often from a years-old public breach) | Includes samples of internal files, client lists or recent emails |
Sent to a personal or generic address, often to many staff at once | Sent to executives, sometimes with a link to a leak site or negotiation portal |
Generic wording, bitcoin address, short deadline | Follows unusual activity: alerts, outages, encrypted files |
No proof offered, or the 'proof' is just your email address | Offers to delete stolen data for payment |
Don't reply or pay
Replying tells a mass-mailer that the address is live and that someone is worried. Paying a bluff invites more demands. Paying a genuine extortionist is a significant decision with legal, insurance and sanctions considerations, and it doesn't guarantee data is deleted. The Canadian Centre for Cyber Security's ransomware playbook (ITSM.00.099) covers the risks of paying in more depth.
Don't forward the email around the office either. Send it to the person handling it (IT or management) as an attachment, then leave it alone.
Verify: do they show real data?
If the email quotes a password, check whether it's one you still use anywhere. If it's old, the sender almost certainly got it from a previous public breach, but change it everywhere it was reused anyway.
If the email contains file names, documents or screenshots, don't open attachments or links on a work computer. Have a responder examine them in an isolated environment and compare them with what you actually hold. Real samples mean you're likely dealing with a data-theft incident, and the response changes.
Preserve and report
- Save the email with full headers; don't delete it.
- Note the cryptocurrency address and any URLs or contact details, but don't visit leak-site links from a work device.
- Report to the Canadian Anti-Fraud Centre and the RCMP's National Cybercrime Coordination Centre through reportcyberandfraud.canada.ca, or call the CAFC at 1-888-495-8501.
- Report to your local police if there is a threat to a person, or if the extortion involves intimate images.
- For a genuine threat to an organization, also report to the Canadian Centre for Cyber Security (cyber.gc.ca/en/incident-management).
If it's genuine: start incident response
Treat a credible data-theft extortion as a confirmed incident. Call your incident responder, your lawyer and your insurer. The investigation needs to establish how the attacker got in, what they took and whether they still have access, while counsel manages any communication with the extortionist.
Whether data was taken also drives your privacy obligations. If personal information was exfiltrated, assess whether there's a real risk of significant harm requiring a report to the Privacy Commissioner and notice to individuals, and record the breach either way. See What to do if your company's data appears on a leak site or the dark web if data appears on a leak site.
Staff awareness
Tell staff that bluff extortion emails exist, what they look like, and that they should report them rather than respond or stay quiet out of embarrassment. A short note after a wave of these emails often stops someone from paying privately. Call our 24/7 line at (289) 582-9930 if you're unsure which kind you've received.
Not necessarily. Old passwords from public breaches are widely traded and reused in these scams. Change that password everywhere it's used, turn on MFA, and report the email.
Related reading.
- PageUnder attack? Start hereIf something is wrong right now, this page tells you what to do in the next few minutes, what to avoid, and which step-by-step guide fits what you are seeing.
- ServiceRansomware responseA plain sequence for a 20 to 200 person organization hit by ransomware: isolate, preserve, scope, recover, assess data theft and notify, with evidence kept intact for…
- GuideWhat to do if your company's data appears on a leak site or the dark webAn alert, a journalist or a client says your data is on a leak site.
- ArticleRansomware Protection for Ontario Businesses: 2026 Defence GuideTwo halves: the controls that make ransomware survivable, with a concrete backup isolation spec, and the first hour if it happens, including who in Canada and Ontario…
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.