So earlier today I had a new login alert regarding an alternate protonmail account I use rarely.
I didn’t recognize it and immediately changed my password and logged every session out. I then enabled 2FA (because it’s an alternate email, I stupidly had not previously). However, I was going through the login history and it said that there was a Linux export that occurred in the 2 minutes between the login notification and getting everything reset. So not great.
Well I figured fuck it, I hadn’t done anything crazy on the account and used it to sign up for some subscriptions and order some kratom, which is legal. Also no credit card info or anything was in that emails history.
Well this where it gets messy/interesting, although I figure it’s just a scammer. An hour or two goes by, and I get a signal message request from a guy saying that I was deanonymized and “your mailbox xxxxxxxxxx@proton data dump is ready to be sent to local DEA agents.” Then asked if I wanted to negotiate, and that not replying within 2 hours means no.
While I at first panicked, I didn’t accept the request and assumed it was a phishing email and the main goal was to get access to my signal, my phone, or extort me for money. And logically, 1) I didnt do anything the DEA is interested in, and 2) he’d be admitting to a crime if he reported anything—hacking is not taken lightly by law enforcement.
He then followed up an hour and a half later saying times up. I then reported and blocked him.
Should I be worried or did I do the wrong thing?
I have protonpass and the other upgrade. Proton hasn’t detected any darknet leaks or anything yet.