Return to Question

1. How did they get that old password?
2. How were they able to relate the two email id's - the one which had received the ancient email containing the password in plain text, and the other email id, which received the ransom message?

1. How did they get that old password?
2. How were they able to relate the two email id's - the one which had received the ancient email containing the password in plain text, and the other email id, which received the ransom message?
3. Edit/add: **Yesterday I tried to login and later viewed the email containing the plaintext pw and today I receive the ransom mail. (How) are the two events related?? I find the timing a bit suspicious...

1. How did they get that old password?
2. How were they able to relate the two email id's - the one which had received the ancient email containing the password in plain text, and the other email id, which received the ransom message? 2.

1. How did they get that old password?
2. How were they able to relate the two email id's - the one which had received the ancient email containing the password in plain text, and the other email id, which received the ransom message?

Edit/add (after a remark in an answer): the two email id's are very similar. If one is FirstLastXXX the other is FirsLastYYY where XXX and YYY are numbers. But the original email (the one which was used to sign up and which also had received the email containing the pw in plain text) did NOT receive any ransom messages.

1. I use Mozilla Thunderbird as my email client.
2. I was using at least one VPN (one on the system, possibly another via the browser (Opera)) at the time that the events below transpired.
3. Recently I revisited a (relatively well known) web forum I was active on many years back. I tried a few different email/pw combinations to log on to the forum. None of them worked - either because the pw was wrong or the account was no longer active.
4. I tried logging in using different browsers.
5. So I searched in my mail client for the forum's name (hoping to find some communication from the forum to check which email account I actually used on it) and found a few old emails one of which contained the password (see next point also).
6. I was on this forum when it was still in its early days - and the then admins thought it was a good idea to send people an email saying your login email/id is xxxxxx and your password is yyyyyy (yes, in plaintext).
7. I tried the newly discovered old password, and it didn't work.
8. It wasn't terribly important to visit this forum, at least it wasn't worth the trouble. So I gave up on this and moved on.
9. When I checked my email this morning, I find this email in my junk folder that says:

Now, the real question: How did they get that old password?

1. I use Mozilla Thunderbird as my email client.
2. I was using at least one VPN (one on the system, possibly another via the browser (Opera)) at the time that the events below transpired.
3. Recently I revisited a (relatively well known) web forum I was active on many years back. I tried a few different email/pw combinations to log on to the forum. None of them worked - either because the pw was wrong or the account was no longer active.
4. I tried logging in using different browsers.
5. So I searched in my mail client for the forum's name (hoping to find some communication from the forum to check which email account I actually used on it) and found a few old emails one of which contained the password (see next point also).
6. I was on this forum when it was still in its early days - and the then admins thought it was a good idea to send people an email saying your login email/id is xxxxxx and your password is yyyyyy (yes, in plaintext).
7. I tried the newly discovered old password, and it didn't work.
8. It wasn't terribly important to visit this forum, at least it wasn't worth the trouble. So I gave up on this and moved on.
9. When I checked my email this morning, I find this email in the junk folder of a different email id, not the one I used previously for the forum, as mentioned in point 5. The email reads:

Now, the real questions:

1. How did they get that old password?
2. How were they able to relate the two email id's - the one which had received the ancient email containing the password in plain text, and the other email id, which received the ransom message? 2.