all of this is speculation but I doubt the person has access to more than their support email account, and I would bet money they got access to it either by phishing password info from that account or else they work at hungerrush and are trying to inelegantly extort their own employer

so there were two mass emails + the first is sent to every customer or at least a lot of customers, but addressed to Hungerrush

presumably they have been emailing hungerrush directly before this with some other proof of the security breach, and hungerrush has this person’s real email address somewhere from those previous emails

then there’s the second email specifically threatening to “expose” passwords and credit card info

this person wants money obviously, and to get it i think they are pretending to be a better hacker than they are

they probably sent the first email to force a response from hungerrush after being ignored

then after sitting around waiting for a response, they maybe realized that they overplayed their hand when they burned through the one piece of leverage they have

spamming a contact list is not a smart thing to do if you have access to more sensitive data. just send hungerrush evidence that you stole their clients’ credit card info, or like, sell the credit card info? there is a cottage industry of stolen card numbers on the dark web

but since this person is not doing that, it it tells hungerrush they probably don’t actually have shit beyond the email account and its contact list

the second email could be the person realizing they were going to be ignored again after they did their contact list magic trick, and that hunger-rush probably knows now that they don’t have anything

or maybe hungerrush isn’t checking their emails in general haha

so now with the second more explicit email, the would-be extorter is making a desperate effort to panic customers into forcing hungerrush to respond, i guess? or as a last ditch effort to convince hugerrush they do have passwords and credit cards

this has a fargo-esque quality to it imo. i think somebody’s desperate and fucking up

but i’m not in IT or cybersecurity, so maybe there is some kind of risk of an ulterior motive or a malicious link in the email. people who got it should be cautious obviously