Hi,
I truly wish I had better news for you, and I completely understand how upsetting this situation must be. When a hacker changes the email address and other account details, recovery can become very difficult, and in some cases, the account may no longer be recoverable through the standard process.
I recommend reviewing the Microsoft recovery guide below to make sure all possible steps have been completed:
Since the account is linked to Minecraft and holds significant progress and purchases, it would also be a good idea to contact Minecraft Support to see what other option available.
I know how much this account means to your brother, and I’m really hoping you’re able to find a way forward.