These are fraudulent and are usually just spam; in some cases they will include a real password based on cracking a leaked password database. (The spammer will

These are fraudulent and are usually just spam; in some cases they will include a real password based on cracking a leaked password database. (The spammer will hope that you've re-used passwords so that the password in the leaked database is also one that you used on an important site. If so, this is a good reminder to use a password manager and not re-use passwords across sites; if you re-use passwords you can potentially allow someone who compromises a less-secure site to learn passwords that also work on a more-secure site.) It's possible that genuine extortion attempts along these lines happen sometimes, but they're extremely rare compared to the relatively low-cost/low-effort spam version that doesn't actually require the spammer to break into anything.