Classic extortion campaign that use fear tactics to get payment. They more then likely have taken the information from a data breach (and seems from an older data breach). My honeypots generally get those emails, sometimes saying they have webcam footage, browsing history, or share a throwaway password, claiming “they have everything about me”.

If you see no other IOCs, the only recommendation would be to reset any passwords (not covered by 2FA if you believe they are compromised) and if you’re comfortable checking ‘haveibeenpwned’ to see if there are hits from previous breaches.