Other than the obvious stealing of your information to possibly sell on the deep web, they could also use this information to prove they are you and take over your account through the official steem process.

As a security professional, we have a saying. You are guilty until proven innocent. NEVER take anything at face value. Imagine anything like that is a scam until you prove it isn't. If there is even a shred of uncertainty, DON'T DO ANYTHING.

You won't get in trouble if it is legitimate and you refuse to do anything. Anybody who works in security will appreciate your doubt and uncertainty when dealing with security related concerns.