Unsure what to do. Harassment beyond phishing

I found out I was part of the data breach with the initial email, and was receiving multiple emails a day to download/update software. It had gradually progressed to the point that I am currently receiving thousands of emails a week, many to a secondary email that was not given to Ledger.

Last week it went far beyond phishing and I do not know what to do.

Between March 20-22 there were sign-ins to accounts belonging to my girlfriend and I, this was while connected to our home WiFi. On the 21st, there was a sign in to my girlfriend's snapchat account. Someone was messaged and her location was sent/others were requested. I do not believe she has 2FA.The following day I found an email indicating a sign-in to my GitHub and Google accounts. I did not have 2FA set up.

On March 22nd I received an email from an @gmx.com address (the first of many from various different names) that included:

• A demand for the seed phrase to my Ledger device or 1.5 BTC
• Indication that they had associated my name with my main Ethereum account and knew how much assets I held.
• That if I did not comply within a week I would begin receiving secrets I did not want to know.
• The contact would continue until they received payment.

Multiple texts were also made from a Google Voice number associated with the above Google account to various contacts saying a few different things:

• I had obtained my crypto through illicit means and if they could provide the seed phrase they would receive a percentage as a reward.
• I was in the hospital/jail and required money for surgery/bail, those contacted were given my address and asked to find the seed phrase or device itself.

A friend who received a text let me know that the number forwarded to my voicemail. I logged onto my Google account to find that the voice number had two additional devices associated with it (aside from Web and my actual phone number), both were phone numbers that do not belong to me. I closed my voice account and began changing passwords to various websites.

Over the next few days I received a number of emails from the same @gmx.com account making similar demands. This email contained a few sentences which I messaged to my therapist regarding money a few months earlier. I ran multiple malware scans on my PC but found nothing.I had in the past (more later in post) removed some malware/spyware from the device.

The week of March 26th my girlfriend went on a vacation which she had planned a few months ahead of time.

A few days after she left, I received an email on April 1st @ 13:00 (which I did not see until a few hours later) demanding $10,000 to "protect me from seeing images that I cannot unsee". Over the next few hours I received emails from various gmx addresses that contained:

• More pictures.
• Each email demanded more money: $20k, $40k... all the way up to $100k.
• A BTC address to send funds to/email to send seed to.
• The last 3 images were not screenshots, but were camera shots from the front-facing camera on the phone.

We spoke, I informed her of the images and that she should run an antivirus on her phone. That night/early morning April 2nd, I installed and ran Lookout Antivirus on my phone as well and detected the following report:

• org.chromium.Chromium.29iVvk riskware detected
• setup-38nuf.apk surveillanceware detected
• Sync Service surveillanceware detected (2x)
• Scrabbler.apk trojan removed

I am not sure what she found on her phone (more on that further in post) but as the pictures were from her time on vacation I can only assume at least surveillanceware was detected.

I haven't installed any software from 3rd parties, neither of our phones are rooted, they require biometric/pin access.

The only past incident I had with spyware or viruses anywhere on the home network was late last year.

Going back to sometime in October or November, I had set up a home media server (External HDD) connected to my router. In January, my girlfriend's laptop (higher end HP which I purchased less than a year prior for her birthday) which she had previously let her nephew borrow was running sluggishly, draining battery, and having trouble opening programs. After running antivirus software we found a crazy number of viruses: something like 20,000 files related to malware and spyware. I connected to the media server to find a movie and found files in almost every folder that I had not placed there, and was unable to delete. I disconnected the device, attached it to an old laptop and ran a scan to find the files were trojans, malware, and spyware. At this point I ran antivirus software and found malware, spyware, and crypto-miners on my PC.

Current Situation:

All of the spyware has been removed, my router has been reset to factory conditions and the password changed. The media server HDD was wiped back when the viruses were initially found, I've set up thorough spam filters set up on my email, and reached out to a legal team that was taking clients for a class action lawsuit (https://classlawdc.com/).

But the data breach and it's implications have made the last few weeks nothing short of a living hell, I'm still struggling to piece together exactly what happened and what I can actually do about it. It has affected many parts of my life.

The morning after our personal account logins, I woke up and my girlfriend was not home, I thought she might be working and I forgot but noticed that she had taken some things with her. After calling her family to see if anyone had heard from her, she called me and was infuriated believing I went into her phone. At this point I had not seen that my accounts were logged into or had any other reason to believe that it was related to Ledger phishing, I had so many things happen so quickly I'm still not 100% sure what is related to what.

We spoke a second time that day at which point she told me that a friend informed her that apps and services can only be used on the device physically and therefore had to have been me. I speculated at this point while we spoke that perhaps it had something to do with all of the spyware removed from our network & devices, but was still in the dark. She has still said that the entire situation is so out there that regardless of what happened, she needed to remove herself from it for the time being.

Additionally, a "friend" (who particularly gets off on drama) caught word of the entire situation in the state it was in then, and began telling mutual friends that if they received a call from me not to answer as I was able to remotely install software that would steal money from them. Thankfully, some of these people reached out to me to get the story straight, unfortunately others did not. I've since had members of my girlfriend's family reach out to members of my family: saying things ranging from me being a hacker, to possibly having a second life, requiring mental intervention, that the entire Ledger data breach was a hoax and I was running a scheme to steal money from friends. I don't know if they've said things to others, who knows about this, and it has been difficult to put all the pieces together because everything happened

I really have no idea what to do at this point, where to even begin putting the pieces of what happened together, or even determining what has to do with what and to what extent or how some of the viruses went undetected.

I feel violated for myself and my girlfriend, someone could see through her camera without her knowing; they have notes between my therapist and myself providing a disturbing amount of context into my personal life as well. I'm worried because I don't even know how many contacts were texted my address informing them that I own enough cryptocurrency for them to go through this much trouble, or what else has happened that I don't know about.

Trying to figure out all of what happened and in what order is made even more difficult by the fact that this whole series of latest events drove a divide between my girlfriend and I.

Ledger's generic response of "don't give our your seed phrase" feels like mocking now. Just like the lawyers I haven't heard back from, they're only concern is "the assets", there's no concern given to all of the other fallout that can come from a data breach. I'm dealing with nonstop phishing emails, (was) dealing with constant calls, and now I have a relationship that's been severely impacted and a handful of people in my life spreading insane rumors about me. None of them I have spoken to have even taken the time to put my email in and verify whether or not I was involved in the data breach. Plus there's the friends and people in my life who don't understand cryptocurrency, associate it with nefarious things, and are saying things like "if you weren't involved in shady things like Bitcoin, maybe this wouldn't have happened."

Is there anyone out there who has had anything similar happen? The law group I reached out to said that a handful of their clients were victims of ransomware/malware/spyware, but didn't provide anything for me to do, just informed me to send the data I did have to their support email for the Ledger case, that was 4 days ago now. I have been longing for the simple days when you just got emails from a Nigerian prince...

Please, I'm at a complete loss. Literally any help or advice on how to proceed would be appreciated so much.