My tenant account became hacked..??? Can you unhack it? in Microsoft Azure?

My Microsoft Azure tenant has been compromised. The Global Administrator account has been accessed by an unauthorized party, and I am currently locked out of the environment.

• Tenant ID / Name: Harith Rizqi
• Impact Level: Critical (Complete loss of access to Azure resources and billing)
• Status: Unauthorized user has started high-cost VM instances. Access Status: I can no longer sign in with my Global Admin credentials.

1. MFA: The unauthorized user has updated the MFA (Multi-Factor Authentication) phone number/app, preventing recovery via standard methods.
2. Suspicious Activity: <mod: PII redacted>@gmail.com

I am the legitimate owner of this tenant. I need to be put in contact with the Azure Data Protection Team to verify my identity and regain access to the Global Admin role.

🛡️ Immediate Steps You Must Take Now

While waiting for a response on Microsoft Q&A, perform these actions immediately:

1. Call the Global Support Numbers

Don't wait only for a forum reply. Call the Microsoft Global Customer Service phone number for your region. When the automated system asks for the product, say "Azure Data Protection Team" or "Azure Account Access."

Tip: Be prepared to provide proof of identity and ownership of the associated domain.

2. Contact your Bank / Credit Card Issuer

If your Azure account is linked to a credit card, the attackers may spin up expensive GPU instances for crypto mining.

Call your bank and place a temporary block on charges from "Microsoft Azure" or "Microsoft Online Services."

3. Check Associated "Recovery" Emails

Ensure that the secondary email address you used for the Azure account is also secure. If the hacker has access to your recovery email, they can intercept any password reset attempts Microsoft sends you.

Action: Change the password and enable 2FA on your personal/company email immediately.

4. Notify your Users

If this tenant is used for production, notify your users that the environment is currently untrusted.