How Do I Recover a Hacked Google or Microsoft Account With My Files Intact

Finding out your cloud account has been hacked is frightening. Your photos, documents, and emails suddenly feel exposed, and you may worry the attacker has deleted everything. The good news is that in most cases the files are still there, and fast, calm action gives you a strong chance of full recovery.

This guide takes you through recovery for a hacked Google or Microsoft account in the right order: regain access, lock the attacker out, then check your files and sharing settings carefully before you relax.

Quick Answer

Use the official Google or Microsoft account recovery page from a device you trust, prove your identity, and set a new strong password. Then sign out all other devices, turn on two-factor authentication, and check deleted files, shared folders, and forwarding rules. Act as soon as you notice the problem, because speed limits the damage.

Signs Your Account Has Been Hacked

Sometimes the signs are obvious, such as a password that suddenly stops working. Often they are quieter. Watch for these warnings:

• Emails in your sent folder that you did not write.
• Security alerts about sign-ins from places you do not know.
• Files shared with strangers, or sharing settings changed.
• Your recovery email or phone number changed without you.
• Contacts telling you they received strange messages from you.
• Files missing, renamed, or moved to the trash.

If any of these appear, do not wait to see if it gets worse. Attackers often change recovery details and passwords within hours to lock the real owner out. Starting recovery early, while your old details still work, makes the process much easier.

Recover a Hacked Google Account

1. Go to the official Google account recovery page from a browser and device you have used before.
2. Enter your email address and follow the questions as accurately as you can.
3. Use an old password if asked, even if it no longer works. It helps prove the account is yours.
4. Complete any code sent to your recovery phone or email.
5. When you get in, set a brand new password you have never used anywhere.
6. Open Security, review devices, and sign out everything you do not recognise.
7. Turn on 2-Step Verification and refresh your recovery options.

Google explains the official process in its help page on recovering a hacked or hijacked Google Account. Answer recovery questions from a familiar location if possible. Google uses signals like your usual device and network to decide whether to trust the attempt, so a home computer often works better than a borrowed phone on mobile data.

If recovery fails the first time, try again carefully rather than guessing. Wrong answers can slow the process. Wait if Google tells you to wait, and use that time to secure your other accounts.

Recover a Hacked Microsoft Account

1. Try signing in. If the password fails, choose Forgot password and follow the reset steps.
2. If your security info was changed, complete the Microsoft account recovery form with as much detail as you can.
3. Give an email address you can access now so Microsoft can reply to you.
4. Include details only the owner would know, such as old passwords, folder names, or recent email subjects.
5. After regaining access, set a new strong password immediately.
6. Review devices and recent activity, and remove anything unknown.
7. Turn on two-step verification and update your security info.

Microsoft publishes its own guidance on recovering a hacked or compromised Microsoft account, including what to do when the attacker changed your security details. The recovery form can be attempted a limited number of times per day, so gather your facts before you submit it rather than rushing.

Lock the Attacker Out Completely

Getting back in is only half the job. An attacker who planned ahead may have left other doors open. Close them all:

• Sessions: Sign out all devices and browsers, then sign back in only on your own.
• Recovery details: Confirm your recovery email and phone number are yours, not the attacker.
• App passwords and connected apps: Remove third-party apps you do not recognise or no longer use.
• Email rules: Check for forwarding rules or filters that quietly send your mail elsewhere. This is a classic trick in hacked email accounts.
• Payment methods: Review cards and subscriptions if the account stores them.

Also secure your email if the hacked account was not email itself, and change reused passwords elsewhere. If the same password protected other services, those are at risk too. Our guide on how to prevent your Google account from being hacked covers the settings that stop a repeat attack.

Check Your Files and Restore What Is Missing

Once access is safe, check your data before assuming the worst. In Google Drive and OneDrive, start with the trash or recycle bin. Deleted files usually stay there for around 30 days and can be restored in a few clicks.

Next, open the activity or details view for important folders to see recent changes. Check shared folders and remove unknown people. Look at files shared by link, and turn off links you no longer need. Both Google Drive and OneDrive keep version history for documents, so you can roll a damaged or edited file back to an earlier good version.

If files were synced to your computer, check whether bad changes synced too. Pause syncing on other devices until you have checked them, so you do not spread deletions. Where a local copy is the good copy, keep it offline until your cloud is clean.

Protect Your Other Accounts on the Same Day

A hacked cloud account rarely stands alone. The same email address and password combination is often used for shopping, banking, social media, and streaming services. Once attackers have one working login, automated tools test it against hundreds of other sites within hours.

Start with the accounts that matter most: your main email, your bank, and any service that stores a payment card. Change those passwords to fresh, unique phrases and turn on two-factor authentication for each one. Then work through smaller accounts as time allows. Tell close contacts what happened, because attackers often message friends asking for money or codes while pretending to be you. A short warning message stops your friends and family from falling for the trick and alerts you if strange messages are still being sent in your name.

Common Mistakes to Avoid

• Paying anyone who offers fast recovery: Only use official Google or Microsoft pages. Strangers who ask for fees or passwords are scammers.
• Using a search ad or fake support number: Type the official address yourself instead of trusting ads.
• Changing the password but leaving sessions active: The attacker may stay signed in on their device.
• Guessing recovery answers repeatedly: Careless attempts can delay or block recovery.
• Forgetting connected accounts: Change reused passwords on other services the same day.

Conclusion

A hacked account is stressful, but most victims who act quickly recover both access and files. Use the official recovery flow, set a fresh password, sign out every other session, and audit your files, sharing, and email rules. Then strengthen the account with two-factor authentication so the same attack cannot succeed twice.

Frequently Asked Questions

Can I recover files the hacker deleted?

Usually yes, if you act within about 30 days. Deleted files sit in the Drive trash or OneDrive recycle bin, and documents also keep version history you can restore from.

How long does account recovery take?

If your recovery phone or email still works, minutes. If the attacker changed your security info, the form process can take a few days while the provider checks your answers.

Should I create a brand new account instead?

Only as a last resort. A new account loses your files, purchases, and history. Try every official recovery step first, and keep trying with accurate details.

Will the hacker still have copies of my files?

Possibly. Anything they downloaded cannot be taken back, so treat exposed documents seriously: replace ID scans, change passwords mentioned in files, and watch for misuse.

What if I cannot answer the recovery questions?

Try from your usual device and location, use old passwords, and give detailed answers. If Google or Microsoft still refuses, repeat the process carefully rather than paying third parties.