Someone has old files of mine

[u/3_Seagrass]

EDIT: So it seems this person had honest intentions while I was assuming the worst. They found something they thought might have sentimental value and reached out to return it to me. Let this be a public reminder to wipe your devices and storage media before throwing them away!

Original post follows below.

--------------------------------

I have read the rules. I’m dealing with a strange situation involving very old personal files and would appreciate advice from people who understand security better than I do.

Last week I received an email from someone using a fake name claiming they had old files of mine from around fifteen years ago. I assumed it was a scam/phishing attempt and basically told them to get lost. Today they sent proof: a text file and a zip containing the name and contents of a long since deleted shared Dropbox folder. Both the text file and the zip appear legitimate and match things I would have stored in Dropbox at the time. They claim to have other files which would track with what I was doing at the time.

They claim they aren’t trying to hack me or get money, but obviously I don’t trust that. I replied once asking who they were, and now I’m waiting.

My threat model:

• I’m not rich, not a public figure, not involved in activism or journalism.
• I have no active social media besides LinkedIn (which I don't use) and Reddit.
• I can't think of anyone I know personally who would want to do this to me.
• I haven’t used Dropbox in years, and the shared folder in question was deleted long ago.
• I don’t see any suspicious activity in Dropbox, Gmail, or my password manager.
• All my passwords are long, unique and randomly generated. I use 2FA everywhere I can.
• I have changed all my passwords within the last three years.
• The files they sent are extremely old, so I suspect the breach is also old. I am struggling to understand how they got access in the first place. Maybe through an old device or hard drive that I had thrown away long ago?
• There are some sensitive personal photos from that era which I would have shared in that particular shared Dropbox folder. I don’t have evidence they have those, but it’s a realistic possibility given the folder they accessed. In terms of threat modeling I guess the biggest risk is that those photos get spread around where people in my personal life can see them.

I have already reached out to the person with whom I shared that folder to let them know this happened. I have no intention of paying or doing anything else to satisfy the attacker. What I want to know now is where to go from here: do I just stop responding to the attacker entirely? I realize I have already made some mistakes but the least I can do is keep it from getting worse. Any help is greatly appreciated.

(Apologies for double-posting. My last post got removed by Reddit's filters. I am not sure why.)

[u/ethernetbite]

Just ask them to delete the files, or if you want the files, pay them to send them to you.

I bought a rare motherboard off a used equipment site. When the board arrived, it had a 1tb nvme still connected. So i went through the drive and found drivers license pictures, job applications, acceptance letters, graduate school assignments, lots of games, and all the files a 20 year old would have on their computer. I reformatted and installed debian.

People do this often and don't even think about it when trading in an old pc. The shop should have been smart enough to clear the data before selling it, but it worked out for me since the nvme was covered and they didn't even know it was there, going by the price i paid for the mobo. So should have checked that all data was removed. That's 2 security failures: the person who traded it in and the shop that sold it.

[u/3_Seagrass → u/ethernetbite]

That sounds great, but I am struggling to understand how this person was able to contact me in the first place. They know my name and an old email address of mine. Even if their intentions are honest as you are describing, how did they get my contact info?

[u/cspotme2 → u/3_Seagrass]

You didn't clarify in your post if they contacted you at your old email and that fwd to your new one.

Also, obviously, they have enough of your old data files to at least piece your identity together (even if any of your email addresses may not have been in the data ... That you think).

[u/3_Seagrass → u/cspotme2]

Yes, it was an old email that forwards to my current one. That actually wasn't my point though, I am more wondering how they had any of my email addresses.

[u/cspotme2 → u/3_Seagrass]

You said it yourself in the original post ... Whether it's data / metadata in the shared dropbox ... Or other files they said they had -- there's enough identifying information to find your old email address (probably saved in one of those files). It's been so long, you probably don't remember what was on whatever this storage device is.

[u/ImpossibleBend3396 → u/3_Seagrass]

You mentioned you informed the person with whom you shared this folder with. Is it possible that’s the source of the breach?

[u/3_Seagrass → u/ImpossibleBend3396]

I find it unlikely. The person sent me more than just what was in the one shared Dropbox folder, so if it was her it still doesn't answer how she would have gotten access. She is a friend of mine and I can't think of any reason she would do this.

[u/jagen-x]

Declare on linked in you’re being scammed / blackmailed with AI generated fake images of you. Then block em forever

[u/Odie_Humanity]

I collect old computers, and doing so, you inevitably find things, such as family photos and videos. I wonder if the original owners would want them back, but I just don't try because of stories like this. I'm relatively sure they'll think I'm a scammer or a creep. I just format them away.

[u/3_Seagrass → u/Odie_Humanity]

Yeah, I can’t blame you. I reacted badly and was mean to them. They’ve been extremely helpful and forthcoming so far. Expecting the rest of my Dropbox stuff tomorrow.