My Son's Account was hacked and Hi-jacked.

Take the following steps immediately to secure and, if possible, recover the account.

1. Run a malware/virus scan on the child’s devices
   • On Windows 10/11 or 8.1, use Windows Defender:
     1. Select Start.
     2. Search for Windows Defender and open it.
     3. Make sure it’s up to date and run a full scan.
   • Ensure any antivirus app is updated and configured to scan regularly. Do this before changing any passwords.
2. Try to recover the Microsoft account
   • Because the password and recovery email were changed, use Microsoft’s hacked-account recovery flow:
     • Follow the guidance in How to recover a hacked or compromised Microsoft account and use the sign-in helper and recovery form to prove ownership.
     • If sign-in fails, use Forgot my password on the sign-in page and choose I think someone else is using my Microsoft account, then follow the prompts.
3. If sign-in is still possible anywhere, immediately secure the account If there is any device where the account is still signed in:
   • Change the password to a new, strong one using the instructions in the hacked-account article.
   • Review and correct account settings that attackers often change:
     • Check connected accounts, forwarding, and automatic replies and remove anything unfamiliar.
   • Go to the Microsoft account Security basics page and:
     • Select Review activity and mark any sign-ins that weren’t his as This wasn’t me or Secure your account.
     • Select Change password and set a strong, unique password.
4. If the account cannot be recovered
   • If the attacker has fully replaced the email and phone and the recovery form fails, the account may be unrecoverable. In that case:
     • Follow the guidance in the recovery-form help and, if still unsuccessful, understand that support cannot override the automated ownership checks.
     • For Minecraft access tied to that account, contact the Minecraft support team as suggested in the referenced guidance to see if any options exist.
5. Harden all related accounts and email addresses
   • For any account that uses the same email address or password:
     • Change to strong, unique passwords.
     • Turn on multi-factor authentication wherever available; this blocks most password-based attacks.
   • Use spam/phishing filters and be cautious of urgent or suspicious messages, links, or attachments.
6. Add safer sign-in and recovery options for the future Once control of any Microsoft account is regained:
   • Go to Advanced security options and Add a new way to sign in or verify (such as a phone number, alternate email, or Microsoft Authenticator).
   • Keep this security info up to date so recovery is possible if something similar happens again.

Because this involves a child’s account, also review Microsoft Family Safety settings to ensure only trusted devices and apps are used, and monitor sign-in alerts for unusual activity.

References:

• How to recover a hacked or compromised Microsoft account
• Hello , welcome to Account help & learning
• What happens if there's an unusual sign-in to your account
• What to do if your email address is leaked
• Help protect your Outlook.com email account
• How to help keep your Microsoft account secure
• My account got hacked. - Microsoft Q&A
• Need help with hacked microsoft account - Microsoft Q&A
• My account got hacked - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A
• Hacker set up continuous draft ransomware email - Microsoft Q&A