It's a con - but a awake up call to change passwords. Basically the sender has bought a load of information from a data breach at some big company. So they have your email, name & password for that site. They are relying on you being panicked [and not having different or have changed your password] . OMG they know my password it must be true. Look at www.haveibeenpwned.com/ and type in your email address it will tell you if it has been included in any data breaches. How do I know?? I had the same email you did and double checked
Arghh!! Moving house and conveyancing frustrations
Our Welfare State. Is it broken?