Lost 4 years of emails due to compromissed account

Question

Hi,

my account was compromised, when I logged in all the emails were still there. Then I started to change the password, deleted newly added sign-in methods, deleted connected apps etc.

When I started deleting the 20 or so rules they created (did not check each rule) about 4 years or emails in the Focused folders and all sent emails vanished.

Checked all the folders, tried searching for them, but they just vanished. Is there a way to get them back? Maybe a backup that Microsoft has?

Thank you.

Answer 1

Hi, I'm John! I will help you with this.

About getting hacked:

Check if you still have access to your Microsoft account and make sure you're currently signed in https://account.microsoft.com/ If you’re locked out, let me know.

Check your account rules and forwarding settings, hackers create rules that automatically forward or delete emails. You can do this in Outlook settings under Mail > Rules and Forwarding. https://support.microsoft.com/office/manage-email-messages-by-using-rules-in-outlook-c24f5dea-9465-4df4-ad17-a50704d66c59

Just to be safe, I’d recommend to sign out everywhere. Visit: https://account.live.com/proofs/manage/additional Scroll down to Sign me out and select "Sign me out".

• After signing out everywhere, please monitor if the issue persists in the coming hours.

And changing your password again and enabling two-step verification if you haven’t already. This will add an extra layer of security to prevent future unauthorized access. "How to help keep your Microsoft account secure" https://support.microsoft.com/account-billing/how-to-help-keep-your-microsoft-account-secure-628538c2-7006-33bb-5ef4-c917657362b9

---

About missing emails:

Since your account was compromised, it’s possible the attacker deleted or moved your old emails.

Please check your Deleted Items folder and click “Recover items deleted from this folder” at the bottom, sometimes older messages can still be restored from there. Also check your Archive or Junk Email folders. "Recover and restore deleted items in Outlook" https://support.microsoft.com/office/recover-and-restore-deleted-items-in-outlook-49e81f3c-c8f4-4426-a0b9-c0fd751d48ce

If the emails don’t appear under “Recover items deleted from this folder,” it means they’ve been permanently removed from the mailbox and unfortunately can’t be recovered.

To prevent this from happening again, I recommend turning on two-step verification and reviewing your recent activity page to make sure your account is fully secure. "How to help keep your Microsoft account secure" https://support.microsoft.com/account-billing/how-to-help-keep-your-microsoft-account-secure-628538c2-7006-33bb-5ef4-c917657362b9

---

Let me know if you have any further questions or concerns.

Click "Add comment" to let me know.

Regards,

John J.D.

Answer 2

Based on the described symptoms (account compromise, many malicious rules, and a large volume of messages suddenly disappearing), the missing mail is most likely either:

1. Hidden/moved by rules, or
2. Deleted (soft- or hard-deleted) as part of the compromise or while cleaning up.

For a consumer Outlook.com account, there is no user-accessible backup/restore feature beyond what is already in the mailbox (including Deleted Items/Recoverable Items). If the messages are not visible in any folder and not recoverable via the standard “recover deleted items” experience, there is no supported way to restore four years of mail from a Microsoft backup.

What can still be done depends on whether this is a Microsoft 365 (work/school) mailbox or a personal Outlook.com/Hotmail account:

• For Outlook.com (personal) mailboxes:
  • Follow the standard missing-email checks:
    • Clear any filters (Filter → All).
    • Review and remove any remaining Inbox/Sweep rules that might still be moving messages.
    • Check the Archive folder and move any found messages back to Inbox.
  • If the mail is still missing after these checks, there is no additional restore mechanism exposed for consumer accounts.
• For Microsoft 365 work/school mailboxes (if that is the case):
  • An administrator can investigate who deleted or moved the messages using the unified audit log, for example:
    • Search-UnifiedAuditLog -StartDate <start> -EndDate <end> -UserIds <user> -Operations SoftDelete,HardDelete,MoveToDeletedItems,Move,Update,Create -ResultSize 1000
  • They can also check whether retention or compliance policies deleted items and whether any holds are in place.
  • If retention policies or holds were configured, an admin might be able to recover items from the Recoverable Items/DiscoveryHolds structure via eDiscovery or mailbox restore tools.

If this is a personal Outlook.com account and the messages do not appear in any folder (including Deleted Items and any “recover deleted items” view), and there is no Microsoft 365 admin for the account, there is no supported way to restore four years of lost mail from Microsoft backups.

---

References:

• Email is missing from your Outlook.com inbox
• Respond to a compromised cloud email account
• Identify who deleted an email message or why an email is missing