MY Microsoft account has been hacked

Do not pay the Litecoin ransom; secure your Gmail and devices first, then use Microsoft’s Sign-in Helper and account-recovery process with the ownership evidence you have.

1. Preserve evidence and stop communicating with the attacker

• Save screenshots of the ransom demand, cryptocurrency address, changed-account notifications, dates, and any unfamiliar email address shown.
• Do not send money, passwords, verification codes, hardware IDs, IP addresses, or identity documents to the attacker.
• Do not publish those details in this public forum either.
• Report the extortion to your local police or cybercrime-reporting authority. Cryptocurrency payment does not guarantee that the account will be returned.

2. Secure Gmail and your devices

Because the Gmail account was also compromised:

1. Recover and secure Gmail through Google’s official account-recovery process.
2. From a clean device, change the Gmail password and any other account using the same or a similar password.
3. Remove unknown recovery addresses, phone numbers, app passwords, forwarding rules, and signed-in devices.
4. On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends completing a full malware scan before changing a compromised Microsoft account password.^1^

3. Start Microsoft’s compromised-account recovery

Open Microsoft’s hacked-account recovery page and start the Sign-in Helper. Enter the original Gmail address or phone number. The tool will show available self-service options or may offer contact with an agent.^1^

If the original address reports “account does not exist,” the attacker may have removed or replaced that sign-in alias. Microsoft accounts can have multiple aliases that share the same Xbox profile, purchases, and account settings.^2^

If the Sign-in Helper offers the recovery form:

1. Supply a different working email address where Microsoft can contact you.
2. Complete it from a device and location previously used for the account, if possible.
3. Include as much accurate information as requested:
   • Original email address and previous passwords
   • Xbox gamertag
   • Xbox console hardware ID, preferably from the console used most often
   • Minecraft/Xbox purchase information and gift-card details
   • Approximate account creation and compromise dates
   • Other Microsoft services used

Microsoft specifically identifies an often-used Xbox console hardware ID as relevant recovery-form evidence. Results are normally sent to the contact address within 24 hours.^3^

Do not send IP addresses, passwords, hardware IDs, or purchase evidence unless the official recovery form or Microsoft agent requests them through a private support channel.

4. Escalate through Microsoft Support if the alias change prevents recovery

If the Sign-in Helper cannot locate the account or complete recovery:

1. Open Microsoft’s Contact Support option from the hacked-account page.
2. Enter Account Recovery or Account hacked or compromised.
3. Select Get Help → Contact Support.
4. Choose Other Products → Manage Account Security.
5. Select Chat with a support agent in your web browser, if offered.
6. Sign in with another accessible Microsoft account if required, and provide a safe contact email.

State clearly that:

• The original Gmail sign-in alias is no longer recognized.
• The attacker replaced the passkey/security information and changed the email alias.
• The account contains the Xbox gamertag and Minecraft Java/Bedrock entitlements.
• An extortion demand was made.
• Ownership evidence is available privately.

A closely matching Microsoft Q&A case—original email removed, unfamiliar passkey address shown, Xbox gamertag and transaction evidence still available—directs users to the hacked-account process and this support route.^4^

Important limitation

Support must complete Microsoft’s ownership-verification process. Agents cannot simply send a password-reset link, disclose the replacement alias, or manually bypass account security.^3^ If a recovery submission is rejected, Microsoft permits another attempt, up to twice per day; improve each submission with older passwords, the frequently used Xbox hardware ID, and exact purchase details.^5^

If any card or payment account was linked, contact the issuer using its official number and review or block unauthorized transactions immediately.

References

1. How to recover a hacked or compromised Microsoft account | Microsoft Support
2. Change the email address for your Microsoft account | Microsoft Support
3. Help with the Microsoft account recovery form
4. Microsoft Account got hacked. - Microsoft Q&A
5. Account recovery unsuccessful | Microsoft Support