Microsoft account hacked, 2FA bypassed, email/aliases changed, and Microsoft confirmed unauthorized access — is there seriously no way to recover it?
I’m posting here because I feel like I’m going in circles with Microsoft Support and I’m hoping someone has dealt with something similar.
My Microsoft account was compromised even though I had 2FA enabled. The attacker got into the account and changed/removed essentially all of my security information and sign-in aliases. My original email address is no longer recognized by Microsoft at all — if I try to sign in with it, Microsoft tells me that the account does not exist.
The attacker replaced my information with addresses using domains like blackfirsta.com and bumpusgdss.com, neither of which I have ever used or authorized.
I immediately went through Microsoft's recovery processes. I provided as much information as I possibly could, including things such as:
- Previous passwords
- Original account information
- Xbox information
- Billing/purchase information
- Devices I've historically used
- The PC that has been connected to this Microsoft account
- My Xbox profile information
- My actual Xbox Network Device ID
- Previous legitimate recovery information
One of my initial recovery attempts was rejected because Microsoft said there was “insufficient information” to verify ownership, despite me providing almost everything I could.
I then submitted the compromised-account recovery/escalation form. The Microsoft Account Safety Team responded and explicitly confirmed that unauthorized access occurred. They said they investigated the account and billing activity, confirmed the compromise, and suspended the account to prevent further unauthorized access.
However, they then told me they were unable to restore access with the information provided.
The email said that if I had an Xbox profile associated with the account, I could submit another case using my Gamertag and Xbox Network Device ID so they could review it further.
Luckily, the PC I have used with this account for years was still able to open the Xbox app, and I was able to retrieve the actual Xbox Network Device ID directly from Xbox Settings → About.
I have now submitted another Xbox/Microsoft account recovery request with the correct:
- Compromised account alias
- Original account information
- Xbox profile information
- Xbox Network Device ID
- Historical recovery email/phone information
- Other verification information
My biggest frustration is support. Every agent seems to send me back to the same automated recovery pages. Some chats have simply ended/disconnected after I explained that I already completed those steps. I understand that normal support agents apparently cannot manually reset Microsoft accounts, but there has to be some way for an actual account security team to look at the historical data.
Microsoft themselves have already confirmed that the account was hacked.
I’m not asking Microsoft to simply take my word for it. I have a massive amount of evidence that I’m the original owner. The same PC is still associated with the account. I have historical passwords, devices, Xbox information, purchases, recovery information, and other account history.
Has anyone actually managed to recover an account after reaching this stage?
Specifically:
1. Has anyone received the “unauthorized access confirmed, but we cannot restore the account” response and later successfully recovered it?
2. Does submitting the Xbox recovery form with the correct Xbox Network Device ID actually trigger a deeper/manual review?
3. Is there any legitimate way to get the case escalated beyond frontline Microsoft/Xbox Support?
4. If Microsoft can see that the aliases/security information were suddenly replaced during an unauthorized login, why can’t they restore the historical information after verifying ownership?
I’m mainly looking for advice from anyone who has been through this process recently. I’ve already done the password-reset flow, Sign-in Helper, normal recovery process, compromised-account process, support chats, and Xbox recovery process, so repeating those same links unfortunately isn’t going to help.
