Yeah...that's a straight up threat and this is a shakedown attempt. We (a large financial) get one of these an hour probably; I don't think we even track them.

Yeah...that's a straight up threat and this is a shakedown attempt. We (a large financial) get one of these an hour probably; I don't think we even track them. There's no one right way to respond. Many options invite retaliation. Loosers like this guy count on you being afraid of that. But security research is a reputation business, and damaging their reputation can be effective. Collect and keep every interaction. Consider that 'responsible disclosure' works both ways. But ignoring it is probably best. Of course...take the time to make sure there aren't any real, low hanging fruit security issues in your site, and take time to set up monitoring so you catch unknown issues quickly. You know...things that you should do anyway.