Things suggested to me so far:

• (Obvious, but must be said) Go change those passwords!
• Don't answer the email and don't pay anybody anything.
• Search for my address at Have-I-been-Pwned; if you find it, your password has been leaked, regardless of this particular person, and is essentially public now. He's just lame.
• Figure out the abuse reporting address for your mail provider (for Outlook365, it's abuse at outlook dot com) and report the incident there.

In my case, "Have I been pwned" says:

Oh no — pwned!

Pwned on 6 breached sites and found no pastes

The breeches listed for me are:

• Collection #1 (unverified)
• Data Enrichment Exposure From PDL Customer
• GeekedIn
• Linkedlin
• Onliner Spamerbot
• Verifications.io

Things suggested to me so far:

• (Obvious, but must be said) Go change those passwords!
• Don't answer the email and don't pay anybody anything.
• Search for my address at Have-I-been-Pwned; if you find it, your password has been leaked, regardless of this particular person, and is essentially public now. He's just lame.
• Figure out the abuse reporting address for your mail provider (for Outlook365, it's abuse at outlook dot com) and report the incident there.

In my case, "Have I been pwned" says:

Oh no — pwned!

Pwned on 6 breached sites and found no pastes

Three of the breeches only contain email addresses, not passwords. The other three are:

• Collection #1 (unverified)
• Linkedlin
• Onliner Spamerbot

Things suggested to me so far:

• Don't answer the email and don't pay anybody anything.
• Search for my address at Have-I-been-Pwned; if you find it, your password has been leaked, regardless of this particular person, and is essentially public now. He's just lame.
• Figure out the abuse reporting address for your mail provider (for Outlook365, it's abuse at outlook dot com) and report the incident there.

In my case, "Have I been pwned" says:

Oh no — pwned!

Pwned on 6 breached sites and found no pastes

The breeches listed for me are:

• Collection #1 (unverified)
• Data Enrichment Exposure From PDL Customer
• GeekedIn
• Linkedlin
• Onliner Spamerbot
• Verifications.io

Things suggested to me so far:

• (Obvious, but must be said) Go change those passwords!
• Don't answer the email and don't pay anybody anything.
• Search for my address at Have-I-been-Pwned; if you find it, your password has been leaked, regardless of this particular person, and is essentially public now. He's just lame.
• Figure out the abuse reporting address for your mail provider (for Outlook365, it's abuse at outlook dot com) and report the incident there.

In my case, "Have I been pwned" says:

Oh no — pwned!

Pwned on 6 breached sites and found no pastes

The breeches listed for me are:

• Collection #1 (unverified)
• Data Enrichment Exposure From PDL Customer
• GeekedIn
• Linkedlin
• Onliner Spamerbot
• Verifications.io