Hey there! Nice to meet you!
Since you have two-factor authentication (2FA) enabled, do you have the 25-character recovery codes for the 2FA?
Also, is the hacker able to change your account's verification methods?
Important: If you have an active 2FA, the account recovery webform (ACSR) will inform you that your recovery request will be ignored.
If you still have the 25-character recover codes and your verification methods linked to your account are not yet changed, please go to account.microsoft.com > Forgot Password > click "I don't have any of these" on both verification methods > click "Yes" on the 25 recovery code (if you have one) > from here, you will be asked to wait 30 days in order to update your security info and recover your account.
During this time, you will not be able to sign in to sites or services with your account.
However, if you do not have access to all of your verification methods (phone and email) and the 25-recovery codes from your 2FA, and the hacker was able to change them, I'm afraid it is no longer possible to recover/verify the account.
Thank you for your understanding.
Best regards,
Darhyl