Hacked Microsoft account: attacker changed username, email and password, sign-in says that account doesn't exist

Hello,

I'm sorry to hear that your Microsoft account has been compromised. Based on your description, it appears the attacker may have changed your account's primary email alias, password, and security information. This could explain why Microsoft no longer recognizes your original email address when you attempt to sign in.

Since you have already submitted the account recovery form and attempted to contact Microsoft Support, I recommend the following additional steps:

1. Try Microsoft's Sign-in Helper

Visit Microsoft's official account recovery guidance:

https://support.microsoft.com/account-billing/how-to-recover-a-hacked-or-compromised-microsoft-account

The Sign-in Helper can identify available recovery options and, in some circumstances, direct you to a support representative.

2. Report That Your Username No Longer Works

Microsoft has specific guidance for situations where an account username is no longer recognized:

https://support.microsoft.com/en-us/accounts-billing/manage/my-username-and-password-have-stopped-working

If Microsoft continues to display "We couldn't find an account with that username," follow the instructions to contact support and explain that you suspect your original sign-in alias was removed without authorization.

3. Preserve Your Evidence of Account Ownership

You mentioned having several important pieces of evidence, including:

Your original Microsoft account email address.

Previous account credentials.

Microsoft security notifications documenting unauthorized changes.

Your Minecraft purchase receipt.

The email address associated with the unauthorized changes.

Preserve these records and provide them only through official Microsoft support channels when requested. Do not publicly share passwords, transaction details, or the suspected attacker's email address.

4. Review Your Security Notification Emails

Carefully examine the original security notification emails from Microsoft. If the changes are still pending, there may be an option to report unauthorized security information changes.

Microsoft applies a 30-day waiting period to certain security information replacements. However, this protection does not necessarily apply to changes involving account aliases or passwords.

5. Contact Microsoft Support Again

Visit:

https://support.microsoft.com/contactus

Explain that this is an account takeover involving an unauthorized primary alias change, not simply a forgotten password.

You can specifically state:

"My Microsoft account was compromised, and the attacker changed my primary sign-in alias, password, and security information. My original username is no longer recognized. I have security notification emails and purchase documentation supporting my ownership. I need assistance identifying the appropriate recovery process for an account takeover involving an unauthorized alias change."

Please understand that Microsoft support agents have security restrictions and cannot manually reset passwords or bypass account ownership verification. Contacting support does not guarantee account recovery.

6. Protect Your Other Accounts

If you reused the compromised password anywhere else, change those passwords immediately. Enable multifactor authentication on your other accounts and scan your devices for malware.

Final Recommendation

Since your account is connected to Minecraft purchases, preserve your Minecraft transaction information as supporting evidence. However, the Microsoft account recovery process remains the primary route for restoring access.

Unfortunately, if the attacker permanently removed your original alias and replaced the account's recovery information, recovery may be difficult. The most important next step is to use Microsoft's official guidance for an unrecognized username and determine whether any verified recovery options remain available.

I hope you're able to regain access to your account. Please let us know whether the security notification emails contain an option to report or cancel the unauthorized changes, as that detail may help identify your remaining recovery options.