**This is a known scam.** The scammers look up emails and cracked passwords in _public_ leaks of site databases and then send an extortion email to people. The password is already out in the open, sorry. You should change the passwords on all sites using that password. On the up-side, this does mean that the person who is emailing you is not actually a hacker and they have _not_ infected your computer.

You should use a [password manager](https://en.wikipedia.org/wiki/List_of_password_managers) to prevent this from being an issue in the future.