Hacked Microsoft 365 Family Account: Recovery Process Loops and No Way to Contact Support

Question

Hacked Microsoft 365 Family Account: Recovery Process Loops and No Way to Contact Support

OM 0

Dear all,

Our Microsoft 365 Family account was hacked in late July. Since then, we have no longer been able to access our family photo archive on OneDrive. I can still see my former OneDrive folders and files on my local PC, but the files cannot be opened because there is no longer a connection to the OneDrive cloud.

I have tried to recover the account using my old username, email address, and phone number, but Microsoft no longer recognizes them (error 0x80048820). The account's sign-in and recovery information was replaced with hacker email addresses associated with the domains @kuganology.com and @issipuna.com, and my username and phone number were removed from the account.

During our recovery attempts, my children accidentally reactivated an old Microsoft account using my current email address. However, this account contains no OneDrive data and is not linked to our Microsoft 365 Family subscription, so there are no suitable support options available through it.

I have repeatedly used the Sign-in Helper and submitted multiple account recovery requests during the last two weeks using both my email address and phone number. However, the process always ends after I enter my credit card information and then starts over from the beginning, creating an endless loop.

How can I reach a Microsoft employee or account security specialist who can review a compromised account when the automated recovery process is stuck and does not allow additional proof of ownership to be submitted?

I can provide the following proof of ownership through a secure channel:

Microsoft 365 Family subscription and billing records
Payment history
Previous email address, username, and phone number
Devices connected to the account
OneDrive folder structure and screenshots
Locally visible OneDrive files and folders

My family and I feel completely helpless at this point. Our OneDrive contains over 15 years of irreplaceable family photos and memories, and unfortunately we do not have a separate backup.

Any advice or assistance would be greatly appreciated.

Thank you very much in advance for your help.

0 comments

2 answers

Your answer

Answer 1

OM 0

Hello Xavier,

Thank you so much for your kind reply and for taking the time to follow up.

I am still trying to recover my account using your recommendations, but unfortunately without success. The attacker replaced all original aliases and security information with unauthorized email addresses, one of which is now the only available recovery method. My original phone number and Skype name are no longer recognized by Microsoft, and my original email address now points to a newly created empty account rather than my original Microsoft 365 account.

The recovery process relies entirely on automated verification and does not provide any way to submit additional evidence or request a manual review. As a result, I am unable to provide information that could help prove ownership of the account.

I truly appreciate your support and remain hopeful that I will be able to recover access to my account and the photos and memories of my kids and family stored in OneDrive, as unfortunately we do not have a backup covering a significant period of time.

Have a nice day too!

Xavier-D 12,515 Reputation points Microsoft External Staff Moderator

2026-09-08T23:50:20.62+00:00

Hi OM

Thank you for the update, and I am sorry the recovery attempts have not succeeded yet. Losing access while the attacker holds the aliases is genuinely stressful.

When every alias and all security details have been replaced, the automated account recovery form is the only supported route back in. Moderators and support agents are not able to reset security information or verify ownership manually, so the priority now is improving the quality of what you submit, because the answers are scored automatically.

When contacting with support:

Answer as many questions as you can: old passwords, exact email subject lines, frequent contacts, billing details, and any Xbox, Skype, or subscription information. Guessing is allowed and wrong answers do not count against you. Thin answers are the usual reason a submission is rejected. Microsoft reviews the form and responds within 24 hours, and you can submit again with stronger detail.

I hope this help.
OM 0 Reputation points

2026-09-09T11:35:33.3133333+00:00
Hi Xavier,

Thank you so much for your kind support.

I have a few more questions:

When reviewing account recovery requests, does the system check historical account information and older account records, given that much of the account information may have been changed by the attacker?

Should I wait longer than 72 hours if I do not receive any response to my latest recovery attempt, or should I simply submit the recovery form twice a day with slightly different entries?

Could you please give me some more tips on completing the recovery form, in particular:

For the initial account identification step, I currently have two options available, as my old user name is no longer associated with an existing account:

Email address: I usually signed in using this email address. However, since I created a new account with the same email address while trying to recover the old one, does it still make sense to use this email address to start the recovery process of the compromised account, or will the system simply identify my new, empty account instead?

Telephone number: I received Microsoft SMS messages on this number in the past, but I believe that the number was removed as a security option by the attacker. Does it still make sense to start the recovery process with the telephone number?

Both: Should I submit recovery requests twice a day and alternate between the email address and the telephone number option, even if I do not receive answers from Microsoft?

Would it be better to skip the Xbox-related questions if we only used Xbox services on a local PC, or should I select one Xbox console from the list even though we do not own one?

I can still see the Windows user name associated with my compromised account on my local PC. The user name that appears in the OneDrive folder path is different from the Windows user name shown on the sign-in screen. Which of these is more likely to be associated with my Microsoft 365 Family account?

Is either of them the same as my old Skype name?

When I have to guess the Skype names of my contacts, would it be safer to enter the Skype email alias that appears before the "@" sign (e.g. "name.surname"), the full name (e.g. "Name Surname"), or the Skype user name if I remember it (e.g. "n_surname")?

I can also still see my son's account on the local device. Would his account name be the same as, or different from, his old Skype name?

Thank you again for your support and guidance. I truly appreciate your help.
Xavier-D 12,515 Reputation points Microsoft External Staff Moderator

2026-09-10T00:00:24.43+00:00
Hi,

I am sorry you are still going in circles while the attacker holds your family account.

The review does look at the account's history, so original sign-up details, old passwords and former security information still count in your favour even though the current details were replaced.

To answer your question:

Expect the result within 24 hours at the working email you gave, check its junk folder, and resubmit rather than waiting 72 hours.

Start the form with the email address only if it still finds the compromised account, because an address now attached to your new account will point the review at that empty account instead.

Skip the telephone option if the attacker removed that number, since the form cannot match security information the account no longer holds.

Use your two attempts a day to add stronger detail rather than to alternate between the two identifiers.

Leave the Xbox console questions blank instead of choosing a console you never owned, and answer only for the services you genuinely used.

Enter the display name shown on the Windows sign-in screen, as the OneDrive folder name comes from the local profile and is not the account name, and neither name is your Skype Name.

Give each contact's Skype Name where you remember it and the full display name otherwise and expect your son's account name and his Skype Name to differ, since wrong guesses do not count against you.

Refer to here for suggestion about how to fill your recovery form:

Help with the Microsoft account recovery form

I hope answering from the original sign-up details, with the identifier that still finds the compromised account, gets your next submission verified.
OM 0 Reputation points

2026-09-10T09:19:33.04+00:00

Hi Xavier,

Thank you so much for your continued support and guidance. I truly appreciate the time you are taking to help me with this situation.

I have now submitted another recovery form with more detailed information and am hoping for a positive outcome.

The telephone number option appears to be the only path that still leads to the compromised account, as the old Windows username is no longer recognized and the email address option redirects me to the new, empty account that I created during my recovery attempts.

Would it make sense to submit the recovery form again with the same details from a different device previously connected to the compromised Microsoft 365 Family account, such as my smartphone or my son's PC?

I also came across the following note on the Microsoft Support website regarding an issue affecting Microsoft 365/Office activation on macOS:

"Update Microsoft 365 or Office on your macOS or iOS device"

Could this be a possible reason for the long delay and the fact that I have not received any response to my previous recovery attempts for the compromised account? Or are there other reasons why the review process might be taking longer than 24 hours?

Thank you again and have a nice day!

Answer 2

Hello OM

I’m very sorry you and your family are dealing with this, especially when the account contains so many years of irreplaceable photos.

Because this is a personal Microsoft account, the official recovery process is the Sign-in Helper and account recovery form. The Sign-in Helper may provide self-help options or offer the opportunity to contact an agent, depending on what it can identify for the affected account:

Recover a hacked or compromised Microsoft account

Since the recovery process is looping, you can also try reaching Microsoft Support directly:

Please note that this is a user-to-user support forum. Moderators and contributors, including external Microsoft employees, are not allowed to directly interfere with Microsoft product features or access back-end systems. Our role is limited solely to providing technical guidance on reported incidents, requests, or ideas.

Open a website link - Contact - Microsoft Support
In the box below "We're here to help", type Microsoft 365, click "Get Help", and then click "Contact Support" below.
In this section, you will need to sign in to your Microsoft account.
Select "Microsoft 365 and Office" under Products & Services, select "Technical Support" as the category, and click to confirm
You can select " Chat with a support agent in your web browser " to access the chat window.

When you reach an agent, clearly explain that the original alias and security information were replaced, the current account using your email address is a different empty account, and the recovery process loops after the billing-verification stage. Ask the agent to document the recovery-loop problem and advise whether the Sign-in Helper can route the case to the appropriate account support channel.

However, it is important to set expectations: Microsoft Support agents are not permitted to send password-reset links or manually access and change the security details of a personal Microsoft account. Ownership must still be verified through Microsoft’s recovery system. If you are directed back to the form, complete it from a device and location previously used with the affected account and provide as much historical information as possible.

In the meantime, do not unlink OneDrive, reset the PC, reinstall Windows, remove the OneDrive folder, or delete any locally visible files. If any files show a green check mark and can still be opened, copy them immediately to a separate external drive. Files showing only a cloud icon may be placeholders and may not contain a local copy.

I sincerely hope the support route can at least help identify why the recovery process is looping and guide you to the correct next step.

Have a nice day.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.