hacked account

Restoring an Outlook.com or Microsoft account mailbox to a previous point in time is not supported. Instead, the account must be secured and any attacker persistence removed so no further tampering occurs.

Follow these steps:

1. Secure the device

• Run a full antivirus/malware scan on the Mac (or any device used to access the account) before changing any passwords. If using Windows as well, Windows Defender or another antivirus should be fully updated and run with a full scan.
• Ensure the OS and apps are fully updated.

2. Secure the Microsoft account

• Go to the Microsoft account security page and change the password immediately after the malware scan is clean. Use a strong, unique password.
• If unable to sign in, use the password reset flow and, if needed, the hacked/compromised account recovery flow described in the recovery article.

3. Review and fix account settings Because someone had access to the account, check and correct these settings (via Outlook.com / Microsoft account web settings):

• Connected accounts: Remove any unknown or suspicious connected accounts.
• Forwarding: Turn off any forwarding rules that send mail to unknown addresses.
• Automatic replies: Remove any automatic replies the attacker may have configured.

4. Check recent activity

• Review the Recent activity page for the Microsoft account to see when and from where the account was accessed. If unfamiliar activity is found, mark it as not yours and follow the prompts to secure the account.

5. Protect the Outlook.com mailbox going forward

• Be cautious with suspicious messages and attachments; use the trusted sender indicators and safety bars in Outlook.com.
• Add alternate email and phone security info so recovery is easier if the account is compromised again.
• Keep antivirus and OS updates current.

If email content was altered or deleted, it cannot be rolled back to an earlier point in time like a snapshot. The focus is on securing the account, preventing further tampering, and using any available message copies (for example, in other clients or backups) to reconstruct important information where possible.

References:

• Help protect your Outlook.com email account
• How to recover a hacked or compromised Microsoft account
• What happens if there's an unusual sign-in to your account
• Hello , welcome to Account help & learning