Compromised email

Question

My email has been compromised, language has been changed, and they are sending out all kinds of email. I have a lot of personal information in there as you can imaging, and it needs to be recovered if possible. What can be done to resolve this matter

Answer 1

Hello, thank you for reaching out to Microsoft Q&A.

May I please know if you have tried to reset your password first?

Follow the security measures to protect your account:

1. Reset your Microsoft account password.

Open an InPrivate/Incognito browser window and use the following link to reset your password: https://account.live.com/ResetPassword.aspx

2. Sign out of your account from all sessions.

Once the password reset is successful, sign in with your account here: https://account.live.com/proofs/Manage

Scroll down until you find Sign out everywhere. Select Sign out everywhere.

Microsoft will sign you out of all the trusted devices you have signed in to, possibly within 24 Hours.

3. Enable two-step verification.

On the Security settings page, under Additional security, turn on Two-step verification. Make sure you have at least three security verification methods active.

Select Add a new way to sign in or verify, select Authenticator app, and complete the steps.

Once you have added these security measures, go to https://account.microsoft.com/profile and sign in with your Microsoft account.

• Change the Language and Country/Region settings in your Microsoft account profile.

Then, go to https://outlook.live.com/mail/0/options/general/timeAndLanguage. Change the language and time zone for Outlook email settings.

---

Answer 2

If your email has been compromised, there are several steps you can take to regain control and secure your account:

1. Identify Symptoms of Compromise: Look for signs such as blocked sending capabilities, missing or deleted emails, suspicious inbox rules, or unusual activity in your Sent Items or Deleted Items folders.
2. Investigate the Account: Use the Microsoft Entra admin center and the Microsoft Defender portal to examine sign-in logs, audit logs, and any suspicious activity associated with your account. This includes checking IP addresses, sign-in locations, and times.
3. Secure Your Account:
   • Change your password immediately.
   • Review and remove any suspicious devices or Multi-Factor Authentication (MFA) methods registered to your account.
   • Revoke access to any applications that should not have permissions to your account.
4. Remove Suspicious Mail Forwarding: Check for any unauthorized mailbox forwarding rules that may have been set up by the attacker.
5. Restore Access: If you disabled your account during the investigation, reset your password and enable the account again. If your mailbox was used to send spam, you may need to remove the user from the Restricted entities page.
6. Contact Microsoft Support: If you are unable to recover your account or need further assistance, consider contacting Microsoft Support for help with the recovery process.

Following these steps can help you regain control of your compromised email account and secure your personal information.