An integrated threat protection solution designed to detect, investigate, and respond to cyber threats across Microsoft 365 services.
Hello floorpedo,
I’m sorry you’re dealing with both an account takeover and errors in Microsoft Defender.
A 400 Bad Request message does not necessarily mean that the Defender website is experiencing an outage. Error 400 can occur when a sign-in request cannot be processed because of an issue involving the account, app, browser, device, or network. In your case, the problem may be connected to the compromised account or the new account that was accidentally created.
Please first use the official Microsoft account Sign-in Helper to recover the original account:
Recover a hacked or compromised Microsoft account
Enter the original email address or phone number associated with the compromised account. The tool will provide the available recovery options and may offer an option to contact a support agent. The accidentally created account is separate and cannot be merged with the original account.
For the 400 error, you can also follow Microsoft’s official troubleshooting guidance:
Resolve Error 400 when signing in
Microsoft has not provided a restoration time based on the information currently available, so we cannot confirm when the site will be accessible for your account.
I hope the Sign-in Helper routes you to the appropriate recovery option.
Feel free reply back to this post if you need further assistance, I'll be happy to help.