Got hacked by a rambler.ru account

Hi Don

I can't login to my windows account on my laptop.

I can't login to my main authenticator account.

I can't login to my main Microsoft account.

I can't login to my office365 and subsequently my one drive backups.

This means also now that some sites are trying to revoke my history, especially ancestry sites as my DNA is uploaded and I turned in two factor authentication.

None of them no longer exist. I can still see everything but not login.

I have also now found an email sent to the new email address at 9 seconds past midnight on the day the email address for notifications was changed. It is from Microsoft and sends an API link to him with no reference or warning to that email or my back up Microsoft account.

I continually pass the account recovery questionnaires but get no codes as there is nothing on the list of retrievable to match my circumstances.

It has now been 7 months if being told I don't understand and told repeatedly to fill in the same automated process that I have already analysed and repeatedly highlighted why it is not fit for my particular scenario.

And still I am ignored.

Over 30 years with Microsoft obviously means nothing is the message I am getting back right now.

I may be patient, and pilute, and understanding. Please do not think it is because I do not understand, actually it is because support at Microsoft do not understand and I do not blame undertrained staff for following procedure.

Please also understand that I will not give up and I understand my rights and service expectations and will keep pursuing such until I am heard and something is done. Ideally a positive response from within Microsoft Corporation .

Regards

Sasha Jones,

Since there's simply no way from what I've read to get back a Microsoft account that's had the primary alias renamed, deleted and all of the associated verification information changed, I think the primary item of interest at this point should be to try and understand how that happened in order to avoid it in the future.

One obvious way is to never get another Microsoft or any other account, since if you can't determine how it happened, the failure is likely to be repeated. It seems from your list that you had the Microsoft Authenticator installed, but I don't understand listing the "main Authenticator account" and main Microsoft account" separately, since these would typically be the same thing?

Though there have been complex hacks using tokens, I suspect that most personal account hacks are much simpler combinations of a breached, brute forced or phished password along with possibly a less secure verification email from someplace like a cable company or other less secure provider who doesn't offer or simply didn't have 2-factor authentication enabled. The other common method has been gamers who've downloaded either cracks, cheats or mods for games, all of which virtually always contain malware and would have provided a hacker with everything they need to bypass 2-Step (2FA) authentication.

Though I believe Microsoft and Google should have either worked faster to provide more secure methods of authentication and/or worked harder to explain these relatively complex issues to their customers, I do understand why this may not have been possible several months ago, since many of the improvements to these systems weren't available at that time.

So, this isn't an excuse, simply an explanation of reality in hopes that some might spend the time necessary to better protect their own accounts, since the bad actors are no longer script kiddies, but rather nation states who are obviously making big money or getting other value out of acquiring existing accounts, personal or business.

Rob

----- Original Message -----

From:  "Microsoft (do not reply)" <maccount@microsoft.com> To: <###########@#####.au>

Sent: Thu, 13 Apr 2023 07:09:41 -0700

Subject: Here's the link that you requested

Note the different time zones