Urgent Escalation Request – Unauthorized Account Access and Loss of OneDrive Data

Question

Urgent Escalation Request – Unauthorized Account Access and Loss of OneDrive Data

Achille 0

Hello,

I am urgently reaching out for assistance with my Microsoft account recovery case.

Someone recently gained unauthorized access to my Microsoft account after tricking my son, who was using the account for Minecraft. After gaining access, the attacker removed my phone number, changed the security information, and I am no longer able to access my account or any of the data associated with it.

I submitted multiple recovery requests (SIR23783218 and SIR23780158), but both responses stated:

"Based on the review, we have confirmed that unauthorized access occurred. During the investigation, we discovered that the security information on your account has been changed..."

I understand Microsoft’s security policies regarding restoring account access after security information has been modified. I am not disputing the need to repurchase any subscriptions. My main concern is the loss of access to my personal data stored in OneDrive.

The attacker also modified my Microsoft Family account. They made themselves the organizer, removed me from the family group, and now have control of the family settings. My wife is the other organizer and was the actual Microsoft 365 Family subscriber. The subscription was shared with our children and myself.

Because the attacker is now an organizer, we cannot remove them from the family group. We also cannot properly manage the family members or restore control of the account. My wife cannot remove herself or correct the situation from her account.

We attempted to close my wife’s account in the hope that this would immediately terminate the family group and remove the unauthorized organizer. However, we discovered that Microsoft requires a 30-day waiting period before the closure takes effect, leaving the unauthorized user with continued control during that period.

My request is not only about subscription access. I am asking for help protecting and recovering my personal data, especially my OneDrive files, which contain important information accumulated over many years.

Could this case please be escalated to a team that can review the unauthorized access situation, restore ownership where possible, or help preserve/recover my OneDrive data?

I can provide any proof of ownership needed, including billing information, Microsoft 365 subscription details, Xbox/Minecraft account information, and any other verification required.

Thank you for your urgent assistance.

Sincerely,
below a picture on the family account with the intruder email ..
User's image

0 comments

1 answer

Your answer

Answer 1

For a hacked personal Microsoft account where the attacker has changed the security info and taken control of services like OneDrive and Family Safety, only the official recovery and support flows can be used. Community forums and general support channels cannot override those systems, restore access, or directly escalate individual cases.

Follow these steps end to end:

Use the hacked/compromised account troubleshooter
- Start with the official guidance for compromised accounts: use the tool described in How to recover a hacked or compromised Microsoft account. The tool asks for the email/phone and then either provides self‑help steps or offers contact with an agent.
- As part of that process, ensure all PCs used to sign in are scanned for malware and fully cleaned before attempting further recovery.
Submit the Microsoft account recovery form as completely as possible
- If normal sign‑in or verification options no longer work because the attacker replaced the security info, fill out the account recovery form referenced in Help with the Microsoft account recovery form.
- Use a separate working email address (yours or a trusted family member’s) so Microsoft can send the result of the review.
- Provide all details requested (old passwords, billing info, Xbox/Minecraft details, etc.). The review team uses only this data to verify ownership.
- Results are sent within about 24 hours. If the account is not verified, the form can be resubmitted (up to two times per day) with any additional accurate information.
Understand the limits when security info has been replaced
- If the attacker has fully replaced the security info and the recovery form does not verify ownership, there is no alternative manual override: support agents are not allowed to send password reset links or change account details outside of the recovery process.
- In that case, the account (and associated OneDrive data) may not be recoverable. This also means Microsoft cannot forcibly remove the attacker from the family group or reassign organizer status for that specific account.
Protect remaining accounts and data
- For any other Microsoft accounts still under your control (such as your wife’s organizer account), follow the same hacked‑account guidance: run antivirus scans, change passwords, and review security info and sign‑in options.
- Review the guidance in How to help keep your Microsoft account safe and secure (linked from the hacked‑account article) to add stronger sign‑in methods and multiple recovery options so future recovery is easier.
Use Sign‑in Helper for additional sign‑in issues
- If there are other sign‑in problems or confusion about which account is which, use the Sign-in Helper referenced in I can't sign in to my Microsoft account and Help with the Microsoft account recovery form. It can help route to the correct recovery or support path.

If the recovery form and hacked‑account tool ultimately confirm that the account cannot be verified, there is no supported way to escalate further to regain that specific account or its OneDrive contents. In that situation, focus on securing all remaining accounts, recreating critical data where possible, and configuring robust security info for each family member going forward.

References: