Consult Legal Help: If you're feeling threatened or coerced by the company's actions, you may want to consult a legal professional. They can provide guidance based on the specific laws and regulations in your jurisdiction.
Don't contact anybody except law enforcement. Attorneys in private practice play no role at all in reporting crimes and attorneys in private practice who handle criminal law represent clients accused of crimes. The only thing an attorney will advise you to do is report it to law-enforcement authorities. In the US, report it to the FBI through: ic3.gov/Home/ComplaintChoice and in the UK, report it to: actionfraud.police.uk/how-to-report-fraud .
Contact Your University: If you feel comfortable, you might want to contact your university's academic advising or student support services to inform them about the situation. They may be able to provide advice on how to handle the matter and any potential consequences.
Contacting your university is the last thing you should ever consider doing. If blackmailers are threatening to contact your university, doing so yourself "pre-emptively" is much like shooting yourself in the knee first, because a blackmailer is threatening to shoot you in your knee unless you pay the ransom. If you admit to your university that you submitted work written by someone else, they'll most likely handle it exactly as they would if you got caught without volunteering the information, yourself. If you never actually submitted the work, you're not in violation of any academic-honesty codes, but universities don't get involved in this kind of problem, at all. They'll simply advise you to contact law enforcement and/or a lawyer, which means you're putting yourself on their "radar" for future reference, for absolutely no reason. They're not going to provide any kind of help, so there's no reason to bring yourself to their attention. Do not even think about contacting your university.
Verify Their Claims: If they're claiming to have information about your university, it's possible that this information could have been obtained through publicly available means. Verify any claims they make before making decisions based on them.
Don't waste your time worrying about it and trying to figure out what's true and/or where thay found any info. Once you're actually being blackmailed, it's too late to do anything other than report it to law enforcement and ignore them and block any means by which they've contacted you. If their threats are bogus, nothing will come of it; and it their threats are real, there's nothing you can do about it, unless you're actually considering paying the ransom, which would be a big mistake. Once they know you're willing to pay them, they're not going to just accept the payment, go away, and leave you alone. They're much more likely to continue threatening you and demanding more money. Where they got their info is a moot point that you shouldn't allow to occupy your time or your mind. Ignore their messages, block all means of contacting you, and report it to law enforcement.
Remember that each situation is unique, and it's important to get advice tailored to your circumstances. Consulting with a legal expert and possibly involving your university can help you navigate this situation effectively and protect your rights and interests.
Actually, if you just search the term "blackmail" on this forum, you'll find that these situations are anything but "unique" and that they're actually remarkably similar, except for very minor details. Sometimes, they deliver some horrible and totally unusable work first, and then they come up with some excuse for demanding more money. Other times, they refuse to cancel the order after you try to cancel, or they come up with some excuse for demanding that you pay for the whole project after you order just a short portion of it, or they demand full payment even though their websites say that there's no obligation to pay anything if you don't like the outline (or draft, or whatever) you tried to order before deciding that you don't want them to produce your project. The differences in the minor details of what excuses or justifications they try to use are irrelevant, because the scheme is always the same: They demand money that you don't really owe them for work that you don't want (or siginificantly more money than you agreed to pay for work that you received) and they threaten to reveal your use of their services to your university. Sometimes, they avoid phrasing it like a threat and they present it as "legal fees" they need to help "protect" you from some totally bogus, nonexistent external threat. These minor differences in the particulars are irrelevant.