Short answer: delete and ignore — don’t reply, don’t pay, don’t engage.
Practical steps:
- If the email contains a password you actually used, change that password everywhere you still use it and enable 2FA on important accounts.
- Mark the message as spam, block the sender, and delete it.
- If you want, save a screenshot (no replies) and report it to your email provider or local police only if the blackmailer has real, specific personal info.
- For low-effort monitoring of exposed info, consider simple tools (I use minimal ones) like Spynger to check if your email appears in leaks.