My outlook has been hacked and problems persist.

Question

I opened my outlook (still as "hotmail") to find most of my emails had disappeared and the few remaining had addresses from known people and businesses, but had a threatening message saying that sensitive material was recorded and I had to pay $500 to get control of my account again. I fixed some of the problem by creating "rules" that delete many of the emails (which kept coming). More insidious, however, was the fact that before my eyes, older emails were being "taken over" by this message. I have signed out everywhere, but still don't know if this has solved it. I've already lost a lot of older emails to this virus-like plague. I cannot find the "consent" page that allows me to inspect the apps to see if there are any nefarious ones. Just looking for advice, thanks, [moderator's note: PII removed]

Answer 1

Hi daniel mclaughlin,

What you are seeing is understandably alarming, especially when older messages appear to be changing and legitimate emails have already disappeared. Please do not use any links or contact details included in it.

Since you created rules to delete these messages, I recommend disabling those rules for now. A broad rule may also remove legitimate mail and make it harder to determine whether the mailbox is still being affected.

Next, open Outlook.com directly in an InPrivate or Incognito browser window and check whether the same altered messages appear there. If the mailbox looks normal on the web but not in an Outlook app, the issue may be limited to the app or its locally cached data.

For the missing messages, check Deleted Items, Archive, and Junk Email. In Deleted Items, select Recover items deleted from this folder and restore any messages that are still available. Microsoft provides the relevant recovery instructions here: Recover and restore deleted items in Outlook.

Regarding the “consent” page you mentioned, could you share where you saw that page referenced or the instructions you were following? The page name and location can differ depending on the account type, so this will help ensure you are directed to the correct settings for your personal Outlook.com account.

If messages continue to change or reappear on Outlook.com after those security checks, please use the Help option in Outlook.com, describe the issue, and select Contact Support when offered. This is a user-to-user forum, so contributors cannot inspect mailbox activity, restore server-side data, or confirm whether an unknown session or application still has access.

Could you also confirm whether the suspicious content appears when viewing the mailbox directly on Outlook.com in an InPrivate window, or only in the Outlook app? Thank you so much for your understanding.     

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The safest next steps are:

1. Run a full malware scan on the PC before changing anything else.
   • Open Windows Security.
   • Go to Virus and threat protection.
   • Select Scan options > Full scan > Scan now.
   • This matters because Microsoft recommends clearing malware before changing the password.
2. Change or reset the Microsoft account password.
   • If sign-in still works, change the password.
   • If sign-in does not work reliably, use the password reset flow.
   • Use a strong password.
3. Check Outlook.com account settings that attackers commonly change.
   • Review connected accounts.
   • Review forwarding.
   • Review automatic replies.
   • Remove anything unfamiliar.
4. Check for suspicious recent sign-ins.
   • Review the Recent activity page to see sign-ins from the last 30 days, including device or app-specific information.
   • If there is activity that is not recognized, continue with the account recovery steps.
5. Use the Microsoft Sign-in Helper.
   • It asks for the email address or phone number and then provides the right self-help steps or an option to talk to an agent.
   • This is also the recommended path if the account is blocked or still cannot be secured.
6. If Outlook.com is still behaving strangely after signing out everywhere, assume account settings may still have been altered.
   • Continue checking for unauthorized forwarding or other changed settings.
   • If self-help does not resolve it, use the support path from the sign-in and Outlook.com help pages.

About the missing older mail: the available guidance confirms that attackers often change mailbox behavior and settings, but it does not provide a supported recovery method for messages that were already replaced or removed. Also check the Archive folder in case some messages were moved there instead of deleted.

For ongoing protection after recovery:

• Add alternate security information such as another email address and mobile phone number.
• Keep the device operating system updated.
• Keep antivirus software updated.
• Be cautious with suspicious messages, especially those without the trusted sender indicators or those showing yellow or red safety bars.

---

• How to recover a hacked or compromised Microsoft account
• Unblock my Outlook.com account
• Email is missing from your Outlook.com inbox
• Help protect your Outlook.com email account