my MS account was hacked into

Question

my MS account was hacked into

Steven Drake 0

Hello,

My MS account was violated last week. Someone got in, then deleted my email, phone #. Then they added their own email and a passkey. I was able to get into my account and delete all of their info. I changed my password and setup 2-step authorization. There have been no more violations.

Here is my question:

First, here's the setup: I'm concerned that the bad guy may have uploaded files from my laptop, which has tax files and other critical and confidential files. This could have been done by synching to OneDrive. I've not ever done this with my sensitive files so my OneDrive folder mostly empty. I do not see evidence that the bad guy did this. He could have uploaded my hard drive to OneDrive, then copied my folders to his local computer, then deleted evidence from OneDrive after copying the files.

My question: Is there a history/log of synching done in my MS account that I can review to see if bad guy did what I described above? I can't find a history in my account pages.

Thank you,

Steve

0 comments

2 answers

Your answer

Answer 1

Hello

Welcome to the Microsoft Outlook Community

Good afternoon, @Steven Drake . I understand the difficulty in regaining access to your account. As the verification of ownership is performed by Microsoft systems, we are unable to recover or change the account directly through the Community.

If you were unable to complete the recovery normally, I recommend using the Microsoft Sign-in Helper first. If necessary, it can direct you to the recovery form:

https://aka.ms/sign-in-helper

When filling out the form, provide as much account-related information as possible. Microsoft advises that the analysis and result are sent to the email address provided in the form, typically within 24 hours.

If the account is blocked or suspended, the procedure is different and the specific reactivation form indicated by Microsoft must be used.

Account Reinstatement Form

To access dedicated support and speak with an agent:

Go to this link Contact – Microsoft Support

Briefly describe your problem in the search box

Scroll to the bottom of the page -> select Sign in to contact support

Sign in to another available personal Microsoft account.

Under Products and Services, select "Other Products"; under Categories, select "Manage account security" and click Confirm.

Click "Chat with a support agent in your browser" (Business hours only)

I hope these guidelines help guide your application. If possible, come back to report the result. Your feedback can also help other community members who are going through a similar situation

Answer 2

A personal Microsoft account has no comprehensive user-visible OneDrive audit log, but because the incident occurred last week, review OneDrive’s 30-day activity feed, Recycle Bin, and Microsoft account sign-ins immediately.

1. Inspect OneDrive’s activity feed

If the account includes a Microsoft 365 subscription:

Sign in to the OneDrive website.
Select Settings → Options → Restore your OneDrive.
Choose Custom date and time covering the compromised period.
Inspect the activity chart and expand each day in the activity feed.
Look for unexpected file or folder creation, modification, movement, or deletion.

The feed shows individual file and folder operations in reverse chronological order for the last 30 days.^1^

Do not select Restore merely to investigate. Restoring would undo selected changes and send files created after the chosen restore point to the Recycle Bin. The Restore feature also requires Microsoft 365.

2. Examine deleted files

In OneDrive on the web:

Select Recycle bin in the left navigation.
Look for unfamiliar folders, tax documents, or folder structures matching the laptop.
If anything relevant appears, record names and timestamps before restoring it.

For personal OneDrive accounts, deleted items normally remain recoverable for up to 30 days. Permanently deleted items cannot be recovered, so an empty Recycle Bin does not conclusively prove that no upload occurred.^2^

Also check current OneDrive storage usage and search My files for distinctive tax filenames. Uploaded files still present would consume OneDrive storage.

3. Correlate with account sign-ins

Open the Microsoft account Recent activity page and inspect the incident period. It shows significant sign-in events from the last 30 days. Expand unfamiliar entries to see the time, approximate location, IP address, device or operating system, browser, and access method.^3^

Mark applicable entries as This wasn’t me and preserve screenshots for your records. Microsoft notes that this page does not show all account activity, so it cannot independently establish whether particular files were uploaded or downloaded.

Personal-account views do not provide the detailed Microsoft 365 organizational audit events—such as FileUploaded, FileDownloaded, FileSyncUploadedFull, and FileSyncDownloadedFull—available through Microsoft Purview for work or school environments.^4^ Therefore, there may be no personal-account record proving that the attacker downloaded a file.

Could the attacker upload laptop-only files?

Possession of the Microsoft account alone does not give an attacker remote access to arbitrary files elsewhere on the laptop. OneDrive syncs files located in its synced folder and any Windows folders explicitly enabled for OneDrive backup. Windows folder backup can include Desktop, Documents, Pictures, Videos, and Music.^5^

Check the current configuration:

Select the OneDrive cloud icon in the Windows notification area.
Open Help & Settings → Settings.
Select Sync and backup → Manage backup.
Note whether Desktop, Documents, or Pictures is enabled.^6^

Files outside the OneDrive folder and non-backed-up folders would require separate access to the laptop—such as malware, remote-control software, or physical access—before they could be copied.

Check the Windows 11 laptop for compromise

Because account logs cannot exclude direct device access:

Save open work.
Open Windows Security → Virus & threat protection → Scan options.
Run a Full scan.
Then select Microsoft Defender Antivirus (offline scan). The computer will restart and scan outside normal Windows, making persistent malware harder to hide.
After restart, open Windows Security → Protection history to review results.^7^

Since the password and two-step verification are already updated, one additional containment action is Microsoft account security dashboard → Additional security options → Sign out everywhere. This signs the account out of browsers and apps within 24 hours, except Xbox consoles.^8^

Absence of suspicious OneDrive activity, deleted files, or stored files lowers the likelihood of the described upload, but the personal-account records cannot prove that it never happened.

References