How to tell if my Onedrive documents were extracted off of Onedrive?

Question

How to tell if my Onedrive documents were extracted off of Onedrive?

Steven Friend 5

I recently received a notification that my Online Microsoft account had been accessed from another country. I did security updates. How can I tell if my OneDrive files may have been extracted (copied) off of OneDrive? Info shows no shares or specific activity.

Bulldog 2,310 Reputation points

2026-02-24T16:45:09.0533333+00:00

You should presume that the attacker has everything that was stored in your Microsoft account - it takes seconds to do that - and take every step to distance yourself from that account. Don't spend time trying to figure out whether your files were copied ... during that time the attacker is able to continue (mis)using what they discovered. Instead, take every step possible to protect your identity.

3 answers

Your answer

Bulldog 2,310 Reputation points

2026-02-24T16:45:09.0533333+00:00

You should presume that the attacker has everything that was stored in your Microsoft account - it takes seconds to do that - and take every step to distance yourself from that account. Don't spend time trying to figure out whether your files were copied ... during that time the attacker is able to continue (mis)using what they discovered. Instead, take every step possible to protect your identity.

Answer 1

DaveM121 888.7K Independent Advisor

1

Log into your Microsoft account on this link and check the recent activity on your account, do you see any login attempts from locations you do not recognize and if so, are they indicated as successful.

https://account.live.com/Activity
2

Then, log into OneDrive in a web browser (https://onedrive.live.com/) and check the last accessed dates on your files to check if any were accessed on the same date(s) of any successful strange logins from other locations on your Microsoft account

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Two Sense 0 Reputation points

2026-06-11T20:38:37.9866667+00:00

How do you check the last accessed dates? I can't see any way to find that info.

Answer 2

Craig Long 18,055

Set up passkeys, but always be mindful of what you click on and download.

Steven Friend 5 Reputation points

2026-02-24T19:39:52.0533333+00:00

Yeah, passkey is set up from computer. I don't use OneDrive from my cell phone at all. It says the access was successful but it flagged it as suspicious. No shares set up, no mods,, no shown activity recorded. Just can't find a way to see if files were copied. Exactly why I am hesitant of anything that stores my data online.

Answer 3

To determine if your OneDrive documents may have been extracted or copied, you can review the OneDrive activity report. This report provides insights into various activities related to your files, such as files viewed, edited, and shared. Here are some steps you can take:

Check the OneDrive Activity Report: Look for any unusual activity, such as files that were accessed or downloaded that you did not initiate. The report will show the last activity date and the number of files viewed or edited.
Review Shared Files: Although you mentioned that there are no shares, double-check the sharing settings to ensure that no files have been shared externally without your knowledge.
Monitor Notifications: Ensure that you have notifications enabled for file activity in OneDrive. This will alert you to any changes or access to your files.
Change Your Password: Since you received a notification about access from another country, it’s a good idea to change your password and enable two-factor authentication for added security.
Files Restore Feature: If you suspect that files have been altered or deleted, you can use the Files Restore feature to revert your OneDrive to a previous state within the last 30 days.

By taking these steps, you can better assess the security of your OneDrive files and take appropriate action if necessary.

References:

Share via

How to tell if my Onedrive documents were extracted off of Onedrive?

3 answers

Your answer