Hacked accounts

Run a full malware scan before changing credentials, then secure the personal Outlook.com account and immediately ask Liberty University’s IT HelpDesk to contain the separately managed school account.

1. Start from a trusted device

If possible, use a different phone or computer that the suspected attacker has never accessed. Do not follow links from unexpected security-alert emails; open the account pages directly.

On the affected Windows PC:

1. Open Windows Security.
2. Select Virus & threat protection.
3. Select Scan options → Full scan → Scan now.
4. If compromise is still suspected, choose Microsoft Defender Antivirus (offline scan). Save open work first because this restarts the computer.

Microsoft recommends completing a malware scan before changing a compromised account’s password, so newly entered credentials are not exposed again.^1^ The offline scan runs outside normal Windows, making persistent malware more difficult to hide.^2^

2. Secure the personal Outlook.com account

From the trusted or cleaned device:

1. Open the Microsoft account Recent activity page:
   https://account.live.com/Activity
2. Review the previous 30 days. Expand unfamiliar entries and, where offered under Unusual activity, select This wasn’t me.^3^
3. Open Security settings:
   https://account.microsoft.com/security
4. Change the password to a new, unique password that has never been used for Google, Liberty, or any other account.
5. Remove unrecognized trusted devices and security methods. Add a recovery phone number and alternate email address that only you control.
6. Turn on two-step verification and review any authenticator methods carefully.
7. In Outlook.com, inspect:
   • Settings → Mail → Forwarding
   • Settings → Mail → Rules
   • Automatic replies
   • Connected accounts or applications
   Delete anything you did not create. Attackers can add forwarding or rules to retain access to messages after the password changes.^1^

If you cannot sign in, use Microsoft’s hacked-account sign-in helper and password-reset process. It can provide self-service recovery or an option to contact an agent.^1^ For additional assistance, select Help in Outlook.com, enter the issue, and use Still need help? → Yes.^4^

3. Treat the Liberty account as a separate incident

A university account is administered by Liberty University, so personal Microsoft-account recovery cannot reset its sessions, password, or authentication methods.

Contact the Liberty University IT HelpDesk immediately through its Information Services support page, preferably from the trusted device. State clearly:

• The account may be actively compromised.
• Other email accounts were deleted today.
• You need the Liberty account temporarily contained.
• Ask them to reset the password, revoke active sessions, remove unknown MFA methods, and inspect suspicious sign-ins, forwarding, inbox rules, and application access.

Liberty’s security guidance directs users with a potentially compromised account to its IT HelpDesk and advises against clicking links, downloading attachments, or replying to suspected phishing messages.^5^ Microsoft’s education guidance likewise assigns risky-sign-in investigation and remediation—including password resets and MFA challenges—to institutional administrators.^6^

4. Contain the wider compromise

After Outlook and Liberty are protected:

• Change passwords for financial, shopping, social-media, and cloud-storage accounts, starting with accounts that use the affected email addresses for recovery.
• Never reuse the new Outlook or university passwords.
• Review recovery email addresses, phone numbers, MFA methods, active sessions, and connected applications on every account.
• Contact Google through its account-recovery process separately; Microsoft and Liberty cannot restore Google accounts.
• Preserve screenshots of alerts, unfamiliar sign-ins, messages, and transaction records. Do not publish email addresses, recovery codes, passwords, or case numbers.
• If money, identity documents, or payment cards may be involved, contact the relevant bank or card issuer immediately.

References

1. How to recover a hacked or compromised Microsoft account
2. Virus and Threat Protection in the Windows Security App | Microsoft Support
3. What is the Recent activity page? | Microsoft Support
4. Email is missing from your Outlook.com inbox | Microsoft Support
5. Phishing Alerts | Information Services | Liberty University
6. Step 3: Identity protection