Windows 10: What does resolved unusual activity mean?? Does that mean the hacker got all my details or...

There was a hacker on my account and I have since changed my password and 2fa to make sure he doesnt get in again, but Microsoft said in session activity”resolved unusual activity” so does this mean he got kicked out or did he solve his own problem and get my info ?

:)

 

My Microsoft account got hacked. What does "resolved unusual activity" mean? Did the hacker successfully access my files?

I have a Microsoft account because I used OneNote for school. It mainly served as cloud storage for my school notes. After I graduated 4-5 years ago, I basically forgot about this account. Everything in this account, including the password, has not been updated for over 5 years. I did not set up 2 factor authentication (it was not an option back then) and the password was not unique (Canva breach leaked the password). Basically I forgot this account ever existed.

Fast forward to today, I received 3 emails from Microsoft regarding unusual activities on my account. I made sure these were not phishing emails. So I logged in, checked the account activity. Sure enough there were multiple unauthorized log in attempts. See Screenshot. And no, these were not my own log ins. I was asleep when all of this occurred.





First question: Looking at the activities from 3 hours ago and 4 hours ago, these were all successful log ins, but under each one, the session activity says "resolved unusual activity". What does this "resolved unusual activity" mean? Does it mean the hacker successfully accessed my account? Or does this mean Microsoft caught them in time and they were prevented from access?

Second question: This one gave me goosebumps. Near the bottom of the screenshot, from 5 hours ago, there's an "automatic sync" from Spain (I live in the US). Microsoft marked it as "unusual activity detected". Does this mean the hacker was blocked from access? Or did they successfully sync the files in my OneDrive?

It looks like there are similar questions on this forum but I have yet to see one that explains what these phrases really mean. In my case, Microsoft was able to detect unusual activity, but did it actually allow the hackers to fully access my account?

Thank you in advance to anyone that answers my questions.

P.S. Ever since discovering these unusual activities, I have changed my password and set up 2FA.

 

unusual activity from the same IP

Earlier today I received a mail that there was unusual activity on my microsoft account. I logged and checked the activity page. It should the unusual activity login as well as the current details of the login I just did to check this activity. Both had
the same IP. I double checked on another site and my IP was indeed that same IP.

On the unusual activity session the following is listed

Device/platform : Windows

Browser/app : Unknown

Session activity : Unusual activity detected

To my knowledge the only app that I am sign into on my account is the MS Feedback hub. Could it be this?

Should I be worried about malware infecting my laptop and that is the cause?

 

Definition of "Unusual Activity Detected"

To start off, this isn't about a phishing scam

Within my actual Microsoft Account page under Recent Activity, it states that yesterday there was "Unusual Activity Detected" from China...

Obviously I don't live in China so i've changed all my passwords as best as i can.

My question is, does this mean that they have accessed my account or does it mean they merely attempted and failed ?

Thank you very much