For a Microsoft consumer account that has been fully taken over and whose security info (email/phone and authenticator) has been replaced by an attacker, Microsoft support is limited to the official hacked‑account and recovery workflows. If those fail, the account and its data (including OneDrive and purchased licenses such as Minecraft) cannot be restored.
From the documentation and moderator guidance:
- When a Microsoft account is hacked, the supported path is:
- First clean the device with an up‑to‑date antivirus and run a full scan.
- Then follow the hacked/compromised account guide to change/reset the password and review account settings such as connected accounts, forwarding, and automatic replies.
- If sign‑in is no longer possible, use the Microsoft account recovery form (ACSR) and provide as much historical information as possible.
- If the attacker has already changed the account’s security information and the recovery form does not succeed, Microsoft support and forum moderators state there is no alternative manual override. Even engineers cannot bypass the security model or decrypt/reassign the account’s data once ownership signals and security info have been replaced. In that case:
- The account is treated as unrecoverable.
- OneDrive files tied to that identity are no longer accessible.
- Games and subscriptions (for example Minecraft) associated with that account cannot be moved; new purchases on a new account are required.
- The reason given is compliance with the Microsoft Services Agreement and privacy safeguards: support agents are not allowed to forcibly transfer control of an account based only on narrative or documents outside the automated verification signals, because that could wrongly hand an account to someone who is not the legitimate owner.
- For future protection of any new or existing accounts, Microsoft’s guidance is to:
- Keep Windows updated and use built‑in protection such as Windows Defender, with regular full scans.
- Add alternate email addresses and mobile phone numbers as security info so recovery is easier if the account is compromised.
- Regularly review recent account activity at the activity page to spot unusual sign‑ins quickly.
- Follow the steps in the hacked‑account article immediately at the first sign of suspicious activity, before an attacker can replace security info.
There is no documented escalation path beyond these automated processes for consumer accounts once security info has been changed and recovery attempts have failed.
References: