This is a known scam. The scammers look up emails and cracked passwords in public leaks of site databases and then send an extortion email to people. The password is already out in the open, sorry. You should change the passwords on all sites using that password. On the up-side, this does mean that the person who is emailing you is not actually a hacker and doesthey have not have any malware oninfected your systemcomputer.
You should use a password manager to prevent this from being an issue in the future.