'They're threatening me with porn': Scam using old LinkedIn data alarms Canadians

Debra Higgins is in her 60s and doesn't visit online porn sites but was nevertheless alarmed when she received an email from an unknown person who threatened to release a video of her doing just that.

"I was panicking," she said. "I was in tears. I was embarrassed. I was scared. I didn't know what to do."

Of course, the video doesn't exist.

But the blunt, aggressively worded email that gave her two days to fork over $1,900 worth of bitcoin was stillupsetting, in large part because it did contain some genuinely personal information about her an old password.

• 'Cryptojacking' hacker trend turns Canadians into cryptocurrency miners

"There was just enough of a grain of truth they know your password and then it goes on to talk about using my computer's camera to videotape me," she said. "So it was very frightening."

It took Higgins, who lives in Qualicum Beach, B.C., nearly two days to build up the courage to contact her son in Calgary and enlist his help in dealing with the situation, but she was glad when she did.

He assured her the email was a common scam that others had also received, and the threat was an empty one.

'Don't panic'

The scam is a particularly convincing one, said Chris Nowell, with Calgary-based ThreeShield Information Security, who has been tracking the proliferation of emails like this for the past few weeks.

He said the would-be victims' passwords were obtainedfrom the 2012 hack of LinkedIn, which exposed the private information of more than 100 million users of the business-oriented social media site.

Scammers are now using the old LinkedIn data to inject an extra level of fear into their targets but, if you get an email like this, Nowell said the fact that they know your password from six years ago shouldn't be immediately alarming.

"Don't panic," he said.

"Know that it's all from a 2012 LinkedIn breach, and you've likely already changed your password for LinkedIn. The biggest risk here is, of course, if you're using the same password for that as you're using for other sites, then those have likely been compromised already."

Paul Rockwell, head of trust and safety atLinkedIn, said the company is aware of the scam.

"We continue to encourage our members to report any messages or postings they believe are scams and utilize our memberhelpcentreas a resource to educate and protect themselves from frauds online," he said in an email.

Scammers have received $50K

Lisa Wilton received a similar email and was pretty sure it was a scam right from the startbut said it still gave her pause.

"It looked like a scam email, but what was a little bit worrying was that in the subject line was my name and a password that I had used before," the Calgary resident said.

"I don't frequent porn sites, but people who do and no judgment I could see them getting very worried about that."

Indeed, at leasttwo dozen people seem to have been worried enough to give in to the blackmail and pay the scammers' asking prices,which vary but typically range in the thousands of dollars.

• What's fuelling the potential bitcoin mining boom in Canada

In just over two weeks of monitoring bitcoin addresses in the emails that he's seen, Nowell's firm has tracked 24 transactions that have sent a total of 4.61 bitcoinsto the scammers.

The price of bitcoin is notoriously volatile but, at current rates, that works out to just shy of $50,000.

Nowellexpects Canadians will see more of these types of emailsin the future.

"When something is successful and starts getting a bit of publicity, we get a lot of copycats," he said.

'Overwhelming sense of embarrassment'

Sure enough, while Higgins was on the phone with CBC News explaining her first experience with the scam, a second email popped up in her inbox, this one demanding $8,000 and giving her24 hours to pay up.

"Even reading this second one, my stomach clenches," she said.

"And I know better, but my initial reaction is still one of: 'Oh my god, whatdo they have? This can't possibly be true.' But then there's this overwhelming sense of embarrassment and I can't even tell anyone because, my god, they're threatening me with porn. That's not even logical but they have my password, so what else do they have?"

Nowell, whose IT-security firm works primarily with small and medium-sized businesses, advises being sure that none of your current passwords are the same as the password you used for LinkedIn in 2012.

Rockwell said LinkedIn's response to the hack "included a mandatory password reset for all accountsaffected."

In general, Nowell said it's advisable to use multi-factor authentication on your accounts to further frustrate would-be hackers and scammers.

And if you receive a porn-video-extortion email?

"Ignore it," he said. "That's the easiestthing."

• MORE CALGARY NEWS |Pot legalization puts 14 RCMP sniffer dogs out of work
• MORE CALGARY NEWS |Commuters in 'shock' after section of Bow River pathway closed in northwest Calgary
• Read more articles byCBC Calgary,like us onFacebookfor updates, and subscribe to ourCBC Calgary newsletterfor the day's news at a glance.