I received an invoice notification from securepay.com@yahoo.com for something I did not purchase. Scam?

I have actually received two of these, one in my spam folder and one in my inbox. I did not make the purchase. There was no reference as to what I bought, where I bought it or any other reference that might help me pinpoint the purchase. The email said not to respond and had an attachment. I am concerned that the attachment may be a virus.