This is a known scam. The scammers look up emails and cracked passwords in public leaks of site databases and then send an extortion email to people. The password is already out in the open, sorry. You should change the passwords on all sites using that password. On the up-side, this does mean that the person who is emailing you is not actually a hacker and does not have any malware on your system.
So what should you do going on? Ignore the email and don't reply. Change the affected password. You should also be using different passwords for each website you sign up to, which prevents leaked passwords from coming back to bite you. This can be easily done by using a password manager.