Hey there! Nice to meet you!
I'm sorry you and your child are experiencing this.
The only way to recover a hacked account is through the official Microsoft troubleshooter guide:
If the account recovery web form doesn't work, and since the security info has been replaced by the hacker, I'm afraid there is no other working method to recover the Microsoft account, and Microsoft Support cannot help either.
However, I would recommend reaching out to Microsoft Support immediately as they can possibly "Suspend" the account permanently once they have confirmed that the account can no longer be recovered in order to prevent the hacker from using it:
Type "Microsoft 365 sign-in problem" > Click "Get Help" > Scroll down and select the option "Sign in to contact Support" > Microsoft 365 and Office > Billing and Account Profile Questions > Confirm > then select "Chat with a support agent in your web browser"
Thank you for your understanding.
Best regards,
Darhyl