Hacked Emails

Question

My email was hacked yesterday and today, I am hoping I have it fully recovered now. Any incoming emails I received while hacked or that were sitting in my inbox previously were overwritten by the hackers message and am unable to see anything in the body of these emails. Is there a way to recover them?

Answer 1

Hello Kendra Tullikopf, 

Thank you for posting to Microsoft Q&A. I understand how alarming it is to discover that your emails have been altered after a hack, and I am glad to hear you are taking steps to recover your account. 

To see if those overwritten messages can be restored, please follow the steps suggested by the Q&A assist above to locate and recover your deleted or altered emails. 

Additionally, because hackers can sometimes maintain access even after a password change through connected apps or hidden inbox rules, I highly recommend taking a few extra steps to fully secure your account: 

1. Remove Connected Access Log in to your Microsoft account and go to the app consent page: account.live.com/consent/Manage. Carefully review the list and remove any apps or services that you do not recognize. 

2. The "Safe Folder" Workaround Often, the malicious code or rules set up by a hacker only target the primary "Inbox" folder. You can create a temporary workaround to safely receive new emails while you clean up the account: 

• In Outlook on the web, right-click on the left sidebar and create a New Folder (you can name it something like "Safe Inbox"). 
• Go to your Settings (the gear icon) > Mail > Rules. 
• Create a new rule with the following details: 
  • Condition: Apply to all messages. 
  • Action: Move to "Safe Inbox." 
  • Crucial Step: Check the box that says Stop processing more rules. 

Now, your new incoming mail will bypass the main Inbox and land securely in this new folder, untouched by any hidden scripts the hacker may have left behind. 

I hope these extra precautions help you regain full control of your inbox. If the problem persists, please do not hesitate to let me know - I will be happy to help you further. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

If the hacker’s message actually replaced the original message bodies, recovery is only possible if the originals still exist in a recoverable folder (Deleted Items → Recoverable Items) or in a backup/export (PST, etc.). Try these steps:

1. Check Deleted Items and Junk Email

• In Outlook/Outlook.com, open Deleted Items and Junk Email.
• If the original messages were deleted rather than overwritten, they may still be there. If found, move them back to the Inbox or another folder.

2. Check the Recoverable Items folder (if using Outlook on the web / Outlook.com or new Outlook)

• In Outlook on the web or Outlook.com, in the left pane select the Deleted Items folder.
• At the top of the message list, select Recover items deleted from this folder.
• In new Outlook: select Deleted Items, then Recover items deleted from this folder.
• Select the items to restore and choose Restore.
• Restored items go back to their original folders when possible; if the original folder no longer exists, messages go to the Inbox.

3. If the items are not in Deleted Items or Recoverable Items

• If the original emails do not appear in Deleted Items, Junk Email, or Recoverable Items, they have likely been permanently removed from the service and cannot be restored through Outlook/Outlook.com.
• In that case, the only remaining option would be any independent backups (e.g., exported PST files or third‑party backup solutions). If no such backup exists, the overwritten content cannot be recovered.

4. Secure the account to prevent further tampering

• Follow the hacked/compromised account guidance to ensure the account is clean and secured so messages are not altered again. This includes scanning devices for malware, changing the account password, and reviewing forwarding, rules, and automatic replies.

---

References:

• How to recover a hacked or compromised Microsoft account
• Email is missing from your Outlook.com inbox
• Recover and restore deleted items in Outlook