My child minecraft (microsoft) account hacked

Follow these steps to deal with the hacked Microsoft/Minecraft account and the added hacker email:

1. First, secure the child’s devices
   • Run a full antivirus/malware scan on the PC or device used for Minecraft and Microsoft Teams before changing any passwords.
   • If using Windows 10/11, turn on and run a full scan with Windows Defender as described in the guidance.
2. Try to recover the Microsoft account
   • Use the official hacked/compromised account helper: select Start on this page and follow the flow: How to recover a hacked or compromised Microsoft account.
   • If sign‑in fails because the hacker’s email is the only verification option, choose the path for I don’t have any of these (or equivalent) and complete the account recovery form with as much correct information as possible (old passwords, approximate creation date, Xbox/Minecraft usage, billing details from the Minecraft receipt, etc.).
3. If recovery succeeds
   • Immediately change the account password to a strong, unique one.
   • Review and clean up security info and aliases:
     • Remove any unknown alternate email addresses or phone numbers.
   • Check Outlook/Microsoft account settings for:
     • Connected accounts
     • Forwarding rules
     • Automatic replies Remove anything you do not recognize.
   • Add an additional secure way to sign in (for example, another parent email or phone) from the Advanced security options page so the account can be recovered more easily in the future.
4. If recovery fails
   • If the recovery form is rejected, submit another request with any extra details that can prove ownership (including information from the Minecraft purchase receipt). The process is automated; if it continues to fail, the account may not be recoverable.
   • For the Minecraft license itself, contact the Minecraft support team separately (as suggested in similar cases) and provide the purchase receipt so they can advise on options for accessing Minecraft again with a different account.
5. Monitor for unusual activity
   • After regaining access (or on any other Microsoft accounts in the family), regularly review the Recent activity page and respond to any sign‑ins that were not performed by the family.
   • Ensure all family members’ Microsoft accounts have up‑to‑date security contact info and at least one extra way to sign in.

These are the only supported ways to recover a hacked personal Microsoft account and to stop verification codes going to the attacker’s email.

References:

• How to recover a hacked or compromised Microsoft account
• How to help keep your Microsoft account secure
• What happens if there's an unusual sign-in to your account
• Microsoft account has been locked
• Need help with hacked microsoft account - Microsoft Q&A
• My account got hacked - Microsoft Q&A
• My account got hacked. - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A