The email may look legitimate but it’s a scam. If this sounds like an email you’ve received, you should disregard it, don’t reply to the scammer and don’t give into any demands.
The cybercriminals may have your old password, but it doesn't mean that they have anything on you. It appears they may have gotten your password from the Yahoo or other internet hacks or data breaches that took place a few months or years ago. Yahoo and the companies who suffered the data breach have forced their users to change their passwords, so they should have nothing to worry about.