Yeah, these are almost always bulk scam emails—they scrape old breach data and hope you panic. Don’t reply, don’t pay, don’t click anything; just mark it as spam, change any reused passwords, turn on 2FA, and run your email through Have I Been Pwned. If they actually included a real password or photo, lock down those accounts and report it to IC3, but paying never makes it stop.