Outlook.com mailbox after compromise: email bodies replaced with sextortion text, attachments intact — can original bodies be restored?

Question

Outlook.com mailbox after compromise: email bodies replaced with sextortion text, attachments intact — can original bodies be restored?

tony hajj 0

Hello,

I am asking about an Outlook.com / Hotmail mailbox issue after an account compromise.

Scenario:

My Outlook/Hotmail account was compromised. After securing the account, I noticed that many existing emails across different folders now show the sextortion scam text as the email body/content. However, the original attachments are still present. In addition, I saw many “[Draft] [Unknown]” messages in Inbox/Drafts that flicker or reappear, and my Inbox was flooded with thousands of copies of the same extortion/spam email.

What I already did:

Changed the Microsoft account password
Enabled two-step verification / 2FA
Signed out everywhere
Checked recent activity
Removed third-party app permissions
Turned off IMAP
Disabled forwarding
Deleted all Outlook rules
Removed suspicious safe-sender entries
Emptied Deleted Items
Ran Malwarebytes on my Mac: 0 threats found

Current problem:

The account seems secured now, but the mailbox data appears corrupted. Existing emails have had their original message bodies replaced by the scam text, while their attachments remain intact.

Question:

Is there any way for Outlook.com / Microsoft to restore the original message bodies or perform a point-in-time mailbox restore to before the compromise? If this is not possible through the normal Outlook web interface, what is the correct escalation path or support team for Outlook.com mailbox data recovery/server-side repair?

I can provide screenshots, but I will avoid posting personal information publicly.

Thank you.

0 comments

1 answer

Your answer

Answer 1

Outlook.com does not provide any point‑in‑time restore or server‑side rollback for personal Outlook.com/Hotmail mailboxes, and there is no documented way to restore overwritten message bodies once they have been modified in the mailbox.

For Outlook.com accounts that appear compromised or corrupted, the supported options are:

Secure the account and verify recent activity
- Use the Recent activity page to review sign‑ins and confirm that no ongoing unauthorized access remains. For guidance, see the “Check the recent sign-in activity for your Microsoft account” section, which explains how to view sign‑ins for the last 30 days and how to handle a compromised account.
Check for rules, filters, and folder moves
- Verify that messages are not simply hidden or moved by filters or rules:
  - In Outlook.com, use Filter → All to ensure all messages are shown.
  - Review Inbox rules and Sweep rules and remove anything suspicious or incorrect.
  - Check the Archive folder and other folders where messages might have been moved.
Use self‑help and Outlook.com support
- For Outlook.com, data‑level recovery (such as restoring original message bodies) is not exposed as a feature. If additional help is needed beyond self‑help, the supported path is to contact Outlook.com support from within the service:
  - Sign in to Outlook.com.
  - Select Help on the menu bar and enter the issue.
  - If self‑help articles do not resolve the problem, scroll to Still need help? and choose Yes to reach support.
- If sign‑in is not possible, use the dedicated “can’t sign in” support entry point.

If the content of existing messages has been replaced, and the messages are not simply filtered, moved, or archived, there is no documented mechanism for Microsoft to restore the original message bodies for consumer Outlook.com accounts. Attachments remaining intact does not change this; there is no supported point‑in‑time mailbox restore for Outlook.com similar to enterprise Exchange Online recovery features.

For further assistance, the only escalation path for Outlook.com mailbox issues is via the Outlook.com in‑product Help/Support experience and the general Microsoft account support channels; there is no separate data‑recovery team exposed for consumer Outlook.com mailboxes.

References: