Email addresses, passwords and credit card numbers stolen in massive data breaches can end up for sale on the dark web.
Scammers use all that stolen information to target people, threatening to release their pornography browsing history to friends and family – whether they visited those porn sites or not.
Here’s how the scam works:
You receive a threat in your inbox. The sender knows your email, at least one password and your secret. They go on to claim proof of porn sites you've visited, videos you’ve watched and access to your list of contacts.
Florida residents Tammy Ward and Michael Batenburg both reported receiving similar threats. In both cases, the author of the emails threatened to send proof of their porn watching activity to everyone in their contacts list. Both Ward and Batenburg, the founder of the Back 2 Basics Christian Ministry, said they don’t frequent those sites and felt they had nothing to fear.
Still, both said it was disturbing to get an email from a stranger with legitimate passwords they’ve used in the past.
In each case, the email demands between $1,000 and $3,000 in ransom in the form of Bitcoin, wire transfer or gift cards.
So how do the bad guys get their hands on your personal information?
Stu Sjouwerman, a cybersecurity expert and the founder of Know Be4, said data belonging to all of us has been leaked via massive security breaches in recent years.
The stolen data often winds up on the dark web and sold in large batches. That information is then used to blast out millions of scam emails, including the porn threat.
Both Ward and Batenburg reported the threat to the Better Business Bureau’s Scam Tracker at www.bbb.org. Reporting the emails won't help track down the bad guys, but it will trigger consumer alerts to warn others.
Red flags that these emails are a hoax include the scammer not providing any details or evidence of the sites visited and their request for an urgent ransom to be paid in gift cards, Bitcoin or wire transfer. Experts say that no matter what the email threatens, you should delete it.
