Windows 10: Account Activity - Unauthorized Access Resolved Unusual Activity

I had unauthorized access to my Microsoft Account:Handheld device icon 12/7/2023 2:56 AMSuccessful sign-inSeychellesDevice/platformAndroidBrowser/appUnknownIP address2a13:2fc2:3162:6b17:ac89:7be7:6f35:4737Session activityResolved unusual activity.I changed my password and enabled authenticator.Can Microsoft provide an activity log for a 3-hour period so to determine what information was compromised?

:)

 

Microsoft account unusual sign-in activity

Thank you for the reply. I have answered your questions in bold.

But I still fail to see why any of the questions/measures apply to my situation when Microsoft's "Review recent activity" log shows no "unusual sign-in activity" whatsoever. There are approximately 20 sessions showing on my activity log currently, and everyone
single one of them shows them to be: my computer, my IP address, my location, my operating system, my browser; all at times of the day when I was on my computer...

So unless Microsoft's "Review recent activity" page is inaccurate, where on earth is the "unusual sign-in activity" and why am I getting daily emails alerting me to something, that according to Microsoft's "recent activity" log, does not exist?

Thanks for your continued help/efforts,

SR

03/03/17: Update: and, FTR, I got the email again last night, 8 days in a row now. And once again, there is no "unusual sign-in activity" showing in my "recent activity" whatsoever.

 

Microsoft account unusual sign-in activity

Since you have checked your recent activity and confirmed that there were no unusual activities made, please provide us the following information:

• Do you have a new phone from a different provider, or any new apps were installed that might try to sign in using your account?

• Some apps that sign in on your behalf including email apps and social media apps tied to a Microsoft account.
• Apps that sign in on your behalf will need to ask for permissions to do so when they are installed, and will prompt you for your Microsoft account and password.

• Do you remember having to enter your password when you set up any Windows Phone or Windows apps?

If you can't think of any reason why a sign in would occur
from a different location, we strongly suggest that you reset your password and check for unusual activity on any other accounts that you might have.

If you suspect that your account was compromised, you can do the following:

• If apps, services, or subscriptions were purchased with this account:

• Sign-in to account.microsoft.com
• Click Review your purchases and make sure there were no new transactions that you didn't make or expect.
• Click Billing info and make sure your billing info wasn't changed.

• If you're using OneDrive to store and share files, photos, or other data:

• Sign-in to OneDrive.live.com
• Click Shared on the side menu
• Review the folders and files that are being shared to make sure files are not being shared with people you don't know or that any shares you made weren't deleted.

• If you're using an Outlook or Hotmail email account:

• Sign-in to outlook.com
• Click the gear-shaped Settings icon, then click Options.
• Check the following settings and restore any that might have been lost or changed:
• Check the deleted mail folder and Contacts lists to make sure unusual messages or contacts weren't added, sent, or deleted.

Please post back with the result for further assistance.

 

My Microsoft account got hacked. What does "resolved unusual activity" mean? Did the hacker successfully access my files?

I have a Microsoft account because I used OneNote for school. It mainly served as cloud storage for my school notes. After I graduated 4-5 years ago, I basically forgot about this account. Everything in this account, including the password, has not been updated for over 5 years. I did not set up 2 factor authentication (it was not an option back then) and the password was not unique (Canva breach leaked the password). Basically I forgot this account ever existed.

Fast forward to today, I received 3 emails from Microsoft regarding unusual activities on my account. I made sure these were not phishing emails. So I logged in, checked the account activity. Sure enough there were multiple unauthorized log in attempts. See Screenshot. And no, these were not my own log ins. I was asleep when all of this occurred.





First question: Looking at the activities from 3 hours ago and 4 hours ago, these were all successful log ins, but under each one, the session activity says "resolved unusual activity". What does this "resolved unusual activity" mean? Does it mean the hacker successfully accessed my account? Or does this mean Microsoft caught them in time and they were prevented from access?

Second question: This one gave me goosebumps. Near the bottom of the screenshot, from 5 hours ago, there's an "automatic sync" from Spain (I live in the US). Microsoft marked it as "unusual activity detected". Does this mean the hacker was blocked from access? Or did they successfully sync the files in my OneDrive?

It looks like there are similar questions on this forum but I have yet to see one that explains what these phrases really mean. In my case, Microsoft was able to detect unusual activity, but did it actually allow the hackers to fully access my account?

Thank you in advance to anyone that answers my questions.

P.S. Ever since discovering these unusual activities, I have changed my password and set up 2FA.