Q:

Sextortion with actual password not found in leaks

I have received one of those typical sextortion scams ("drive-by exploit", filmed by webcam (mine has tape on it), pay bitcoin etc.). The thing is that an old password of mine is included (I don't even remember where I used it), but searching the password on HaveIBeenPwned returns nothing (I have previously been notified of two leaks, Last.FM and MyFitnessPal, but those accounts use different passwords).
That got me wondering: since this seems to be a rather old password, how complete are databases like HaveIBeenPwned, and where could I report such a new exploit, other than the authorities?

A:

While services like HaveIBeenPwned are fairly extensive, there are still many stolen user / password lists that have not been revealed to the public eye. Maybe a company didn't actually disclose what happened, never realized anything happened, and/or no researcher has yet found the list. Unless you somehow find the list that included that password somewhere, there isn't a good option to try and report this incident.

A:

Services like HaveIBeenPwned only store passwords that have been publicly leaked in attacks. They have no way of knowing if you have changed your password since, and they have no way of knowing if your password has been leaked via other means.
EDIT: just noticed that you were searching your passwords on there. You might have better luck searching usernames or email addresses

A:

To add, Troy Hunt has previously stated that there are occasions where he has been in receipt of compromised credentials and has decided NOT to include those in HIBP.
https://www.troyhunt.com/the-red-cross-blood-service-australias-largest-ever-leak-of-personal-data/
"As a result, I offered to permanently delete the copy I was sent and not load it into HIBP. As of Thursday evening, that's precisely what I did - permanently deleted every trace of it I had. This isn't unprecedented, I took the same steps as part of the clean-up in the wake of the VTech data breach and for all the same reasons it made sense then, it makes sense now. As with VTech, this should give those who were exposed in the incident just a little bit more peace of mind that their data has been contained to the fullest extent possible."
In practice, the ones in HIBPe will have already been in circulation amongst the 'bad guys' for some time, and have either already been exploited or have been determined to be not worth the effort.

