my one drive was hacked. they stole my files. how do i get them back

Question

My email was compromised on March 2. I got a blackmail email from a hacker on March 2 saying they downloaded all my files. I didn't believe them...until now. I tried to open folders in my one drive where I have individual word documents saved within the folders. The word documents have all been deleted, perhaps by this hacker.  How do I get my files back?   

More info: I opened a new microsoft email (I now have two active email accounts).  I changed my phone number.  I updated my payment details because I closed the bank account that the hacker stole funds from.   I didn't realize until today that my one drive files are gone.   What can I do to get them back? 

Answer 1

Hello Colleen Leduc

I can see that your OneDrive was hacked and the hacker stole your file. Now you wish for a way to recover them.

Since Q&A assist already provided several methods for you to try, I would like to add way to contact Microsoft in case you still need further assistance:

1. Open a website link - Contact - Microsoft Support 
2. In the box below "We're here to help", type Microsoft 365, click "Get Help", and then click "Contact Support" below. 
3. In this section, you will need to sign in to your Microsoft account. 
4. Select "Microsoft 365 and Office" under Products & Services, select "Technical Support" as the category, and click to confirm 
5. You can select " Chat with a support agent in your web browser " to access the chat window. 

Please note that this is a user-to-user support forum. Moderators and contributors, including external Microsoft employees, are not allowed to directly interfere with Microsoft product features or access back-end systems. Our role is limited solely to providing technical guidance on reported incidents, requests, or ideas.  

I hope you can get the support you need, have a nice day.

Answer 2

To try to get the deleted OneDrive files back and secure the account, follow these steps in order:

1. Secure the Microsoft account first
   Because the email was hacked and there was financial fraud, treat the Microsoft account as compromised and go through the official recovery/lockdown flow:
   • Use the Microsoft “hacked or compromised account” helper: How to recover a hacked or compromised Microsoft account.
   • Follow the steps to secure sign‑in, reset passwords, and review security info.
   • If the recovery form is used, provide as much accurate information as possible (old passwords, typical contacts, etc.).
2. Check OneDrive Recycle Bin
   Once signed in safely to the original OneDrive account that held the files:
   • Go to the OneDrive website and open the Recycle bin.
   • Look for the deleted Word documents and folders and restore them if present.
3. Use OneDrive ransomware recovery (if offered)
   If Microsoft 365 detected mass deletion or encryption as a ransomware pattern, OneDrive may show a ransomware recovery flow:
   • Sign in to the OneDrive website.
   • If a ransomware attack was detected, a Signs of ransomware detected screen appears. Select Get started.
   • Step 1 is Confirm your files are infected: review the suspicious files shown, and if they look wrong, choose My files are infected to continue.
   • Follow the guided steps to clean devices and then Restore your OneDrive to a point in time before March 2 using the restore wizard.
4. Restore OneDrive to a previous point in time (if available)
   As part of the ransomware flow, or from the OneDrive restore feature, choose a date before the deletion (for example, March 1) and restore the library. This can bring back files that were deleted or modified by the attacker.
5. If the account itself is lost
   If the original Microsoft account that owned the OneDrive cannot be recovered (for example, the hacker replaced all security info and the recovery form is repeatedly denied), there is no additional supported method to regain access to that OneDrive or its files. In that case, the data in that account cannot be recovered.
6. Clean devices and prevent future compromise
   • Run a full malware scan on all PCs and devices that accessed the account.
   • Ensure unique, strong passwords and multi‑factor authentication are enabled on the recovered Microsoft account and on the new email account.
   • Review recent sign‑ins and security alerts in the Microsoft account security page and sign out of all sessions if offered.

---

References:

• Ransomware detection and recovering your files
• How to recover a hacked or compromised Microsoft account
• My account got hacked - Microsoft Q&A
• my microsoft account has been compromised - Microsoft Q&A
• Need help with hacked microsoft account - Microsoft Q&A
• hello my email was (Moderator note: PII removed)@icloud.com and now its (Moderator note: PII removed)@jerkoffmail.com can please someone help me and the team change it my username in xbox is (Moderator note: PII removed) please help me team and change it - Microsoft Q&A