my MS account was hacked into

A personal Microsoft account has no comprehensive user-visible OneDrive audit log, but because the incident occurred last week, review OneDrive’s 30-day activity feed, Recycle Bin, and Microsoft account sign-ins immediately.

1. Inspect OneDrive’s activity feed

If the account includes a Microsoft 365 subscription:

1. Sign in to the OneDrive website.
2. Select Settings → Options → Restore your OneDrive.
3. Choose Custom date and time covering the compromised period.
4. Inspect the activity chart and expand each day in the activity feed.
5. Look for unexpected file or folder creation, modification, movement, or deletion.

The feed shows individual file and folder operations in reverse chronological order for the last 30 days.^1^

Do not select Restore merely to investigate. Restoring would undo selected changes and send files created after the chosen restore point to the Recycle Bin. The Restore feature also requires Microsoft 365.

2. Examine deleted files

In OneDrive on the web:

1. Select Recycle bin in the left navigation.
2. Look for unfamiliar folders, tax documents, or folder structures matching the laptop.
3. If anything relevant appears, record names and timestamps before restoring it.

For personal OneDrive accounts, deleted items normally remain recoverable for up to 30 days. Permanently deleted items cannot be recovered, so an empty Recycle Bin does not conclusively prove that no upload occurred.^2^

Also check current OneDrive storage usage and search My files for distinctive tax filenames. Uploaded files still present would consume OneDrive storage.

3. Correlate with account sign-ins

Open the Microsoft account Recent activity page and inspect the incident period. It shows significant sign-in events from the last 30 days. Expand unfamiliar entries to see the time, approximate location, IP address, device or operating system, browser, and access method.^3^

Mark applicable entries as This wasn’t me and preserve screenshots for your records. Microsoft notes that this page does not show all account activity, so it cannot independently establish whether particular files were uploaded or downloaded.

Personal-account views do not provide the detailed Microsoft 365 organizational audit events—such as FileUploaded, FileDownloaded, FileSyncUploadedFull, and FileSyncDownloadedFull—available through Microsoft Purview for work or school environments.^4^ Therefore, there may be no personal-account record proving that the attacker downloaded a file.

Could the attacker upload laptop-only files?

Possession of the Microsoft account alone does not give an attacker remote access to arbitrary files elsewhere on the laptop. OneDrive syncs files located in its synced folder and any Windows folders explicitly enabled for OneDrive backup. Windows folder backup can include Desktop, Documents, Pictures, Videos, and Music.^5^

Check the current configuration:

1. Select the OneDrive cloud icon in the Windows notification area.
2. Open Help & Settings → Settings.
3. Select Sync and backup → Manage backup.
4. Note whether Desktop, Documents, or Pictures is enabled.^6^

Files outside the OneDrive folder and non-backed-up folders would require separate access to the laptop—such as malware, remote-control software, or physical access—before they could be copied.

Check the Windows 11 laptop for compromise

Because account logs cannot exclude direct device access:

1. Save open work.
2. Open Windows Security → Virus & threat protection → Scan options.
3. Run a Full scan.
4. Then select Microsoft Defender Antivirus (offline scan). The computer will restart and scan outside normal Windows, making persistent malware harder to hide.
5. After restart, open Windows Security → Protection history to review results.^7^

Since the password and two-step verification are already updated, one additional containment action is Microsoft account security dashboard → Additional security options → Sign out everywhere. This signs the account out of browsers and apps within 24 hours, except Xbox consoles.^8^

Absence of suspicious OneDrive activity, deleted files, or stored files lowers the likelihood of the described upload, but the personal-account records cannot prove that it never happened.

References

1. Restore your OneDrive | Microsoft Support
2. Restore files deleted from your OneDrive | Microsoft Support
3. Check the recent sign-in activity for your Microsoft account
4. Audit log activities
5. [Windows 10](https://support.microsoft.com/windows/experience/backup-recovery/back-up-and-restore-with-windows-backup#back-up-your-pc)
6. Move files to a new Windows PC using OneDrive
7. Virus and Threat Protection in the Windows Security App | Microsoft Support
8. How to sign out of your Microsoft account everywhere | Microsoft Support