Preserve the evidence first.
The single most useful thing you can do in a sextortion case is to stop, preserve, and decide with help — in that order.
Before you reply, pay, or delete anything, the threat itself should be captured: every message, the platform metadata, the sending-account details, and attached files with their hashes intact.
That preserved record is what later supports a platform takedown, an FBI IC3 referral, or a civil action.
Acting first and reacting second is what keeps a private incident from becoming a public one.
If a minor is involved — if you are under 18, or you are a parent and the person targeted is your child — please start on our safety-first page for minors and families instead.
It has the right crisis resources, captures nothing, and carries no tracking.
You are not in trouble, and the help there is free.
Why paying usually backfires
Paying tends to confirm you are extortable, raises the demand, and can land you on a network “suckers list” sold across operators — we have seen a first payment turn into months of rising asks.
Payment also moves over cryptocurrency rails that are forensically traceable.
Non-payment plus quiet legal escalation is consistently the better outcome, but preserve the threat first and decide with counsel.
Already paid? It is not too late — the transaction becomes traceable evidence, and stopping any further payment is the first priority.
Find the source, then lock it down
We audit your own digital surface to find how the material got out — a compromised email or iCloud, a monitored device, exposed cloud storage, or a former contact who kept access — then rotate credentials, revoke sessions, and remove monitoring software while preserving the evidence.
We also run lawful attribution analysis (wallet tracing, IP geolocation, infrastructure overlap); the individual operator is rarely identifiable, the network usually is.
What we coordinate
We hand the preserved evidence and findings to your counsel and coordinate the steps that sit outside digital forensics: platform trust-and-safety takedowns, an FBI IC3 referral, and — where a matter needs field investigation — a licensed private investigator who works under their own license, their contract, and their report.
Realistic expectations up front: attribution supports legal process, it is not a guaranteed name and address.
Where the leak exposed more than the threatened material, our digital forensics for individuals and privacy and exposure services close the surface that let it happen.
