If your Microsoft account, Outlook email, OneDrive or Microsoft 365 login has been accessed, start by protecting the account that controls password resets.
Prepared and reviewed by IT Life-Raft
UK-based IT support and cyber recovery guidance. Last reviewed September 2026.
Use a clean device. Do not approve unexpected MFA prompts, do not share codes, and do not keep using a device you think may be compromised.
If you've been hacked, start with our step-by-step recovery checklist. It explains what to secure first, how to protect your email and accounts, what evidence to keep, and what to do next.
Recovery checklistIf this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
If this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
If this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
If this is happening, preserve evidence and move carefully before deleting messages, wiping devices or changing settings from a suspect device.
Keep the order simple: contain the issue, recover control, then strengthen the account or device so the attacker cannot return.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
Record what you changed and keep screenshots or reference numbers where possible.
For business Microsoft 365, review administrator roles, conditional access, mailbox rules, forwarding, OAuth apps, audit logs and whether customer or staff data may have been exposed.
If money, customer data, Microsoft 365, business email or a website is involved, get advice before wiping evidence or assuming the issue is closed.
These links help confirm the official recovery route. Use them alongside the checklist, especially when account recovery, fraud reporting or business data may be involved.
Only from a trusted device. If the device may be infected, use a different phone or computer before changing the password.
Yes. OneDrive files can be viewed, shared, deleted or encrypted if the account is compromised.
Check sign-ins, admin roles, mailbox rules, forwarding, MFA methods, OAuth apps, audit logs and data exposure.
Tell us what happened, what is affected and whether money, customer data or business systems may be at risk.