Emails Hacked

Question

Emails Hacked

Natalie 0

My email was hacked tonight and I received notification regarding suspicious activity so I logged onto my account and they had changed the language to Vietnamese. I can see that within a few minutes my account was logged into in 4 separate countries. I managed to change my password and change the language back to English. I then checked and they had put on a rule that all emails were forwarded to another email address, so I have taken that off.

I am now receiving ads by email and on the side bar when in outlook account in Dutch. I can't change this back.

Does anyone know if this means they are still accessing my account?

0 comments

2 answers

Your answer

Answer 1

Regarding the Dutch advertisements, seeing ads in a different language does not necessarily mean someone still has access to your account. Advertising content can be influenced by regional preferences, browser cookies, and previously collected information. To better understand what's happening, could you please clarify a few details?

Are only the advertisements appearing in Dutch, or are parts of Outlook's interface also displaying Dutch? Are the Dutch-language emails coming from unfamiliar senders, or are they advertisements from companies you previously received messages from? Does this happen in different browsers, or only in the browser you normally use?

Open your browser in an InPrivate or Incognito window, sign in to https://outlook.live.com, and check whether the advertisements still appear in Dutch. If they appear in English in the private window, the behavior could be related to stored browser data or cookies rather than an ongoing account compromise.

Please share your findings. Since your account was recently compromised, I would also recommend avoiding links in unexpected advertising emails until you're confident they are legitimate.

Answer 2

The Dutch ads/sidebar content does not by itself prove the account is still being accessed. After a compromise, attackers often change account or service settings, and some pages or content can continue showing a different language even after the main display language is changed back.

What matters most is whether the account is now secured. Since the password was already changed and the forwarding rule was removed, the next checks are:

Review recent sign-in activity.
- Go to the Recent activity page and verify whether there are any new sign-ins, devices, or locations that are not recognized.
- Microsoft shows sign-ins from the last 30 days.
Check account settings that attackers commonly change.
- Review connected accounts.
- Review forwarding.
- Review automatic replies.
- If any suspicious settings remain, remove them.
Sign out of active sessions everywhere.
- Use the Microsoft account security options to remove trusted devices or sign out everywhere so any existing attacker session is forced out.
- This can take time to fully apply.
Check for other compromise symptoms in Outlook.
- Missing or deleted mail.
- Suspicious Inbox rules.
- Suspicious messages in Sent Items or Deleted Items.
- External forwarding that was recently added.
Secure the device used to access the account.
- Run a full antivirus or malware scan before making further security changes.
- Keep the operating system and antivirus updated.
Strengthen recovery and sign-in protection.
- Add or review alternate email address and mobile phone security info.
- Turn on multi-factor authentication.
- Use a strong, unique password.

If new unfamiliar sign-ins continue to appear on the Recent activity page after the password change and sign-out actions, that is a strong sign the account or device is still at risk. If the account cannot be fully secured, use the Microsoft account recovery/sign-in helper flow, which can also route to support.