Microsoft Account Hacked? What to Do Now

A compromised Microsoft account can mean losing access to Outlook or Hotmail email, OneDrive files, and anything else tied to that sign-in. Microsoft's recovery process is different from Google's and a little slower, but it works reliably if you follow it carefully.

Signs Your Microsoft Account Has Been Hacked

• You can no longer sign in, or your password has silently changed.
• An email from Microsoft about a sign-in or security change you didn't make.
• Emails sent from your account that you didn't write.
• Your recovery email or phone number has been altered.

Step 1: Use the Official Recovery Form

Go to account.live.com/acsr directly (again, type it manually rather than clicking a link from an email). Microsoft will ask for details about the account — recent passwords you remember, other email addresses you've used to sign in, and any recent activity. The more accurately and completely you fill it in, the faster the review goes.

Step 2: Expect a Review Period

Unlike some instant-recovery flows, Microsoft's account recovery form is typically reviewed by a real process rather than resolved instantly — it can take anywhere from a few hours to a few days. This is normal; resubmitting repeatedly doesn't speed it up and can sometimes slow it down.

Step 3: If You Still Have Access

If you can still log in but something feels off, go to account.microsoft.com/security and check:

• Sign-in activity — review recent sign-ins and flag anything unfamiliar.
• Security info — confirm your recovery email and phone are still correct.
• App passwords and connected apps — remove anything you don't recognize.
• Password — change it, and avoid reusing one from another account.

Turn On Two-Step Verification

Microsoft's two-step verification, ideally paired with the Microsoft Authenticator app, meaningfully cuts the risk of this happening again. See Setting Up Passkeys and Authenticator Apps for setup steps that apply here too.

If the Account Is Tied to a Work or School Login

Accounts managed by an organization (a work or school Microsoft 365 login) can't be recovered through the personal-account form — you'll need to contact your organization's IT administrator instead, since they control the underlying account.

After You Regain Access

The same credentials being reused across services is one of the most common reasons an account gets hacked in the first place. If your email is involved, see what to do after any email account is hacked for the broader cleanup checklist.

Checking Your Broader Exposure

A hacked account is often a symptom of a wider data exposure, not an isolated incident. Scan My Shadow checks your phone number and email across 1,500+ sources so you know exactly what's out there.

Related Reading

• Google Account Hacked? What to Do Now — the equivalent process for Gmail and Google accounts
• Twitter/X Account Hacked? What to Do Now — recovery steps if X is also affected
• My Email Account Was Hacked — What to Do — the broader email-recovery playbook
• Setting Up Passkeys and Authenticator Apps — how to make this much harder to repeat