Microsoft deleted a hacked user's 25-year-old Xbox account, along with his OneDrive baby photos (Updated)

Daniel Sims

Posts: 2,476   +75
Staff
Ripple effect: For the second time in less than a week, Microsoft's account security protocols have sparked discussion across social media. As the Redmond firm and Sony plan to shift away from physical media, more users are realizing they don't truly own anything tied to a digital account or a cloud server.

Update (July 16): Microsoft has restored Joshua Khane's 25-year-old account, returning access to his Xbox library, OneDrive files, and irreplaceable family photos after initially describing the closure as permanent. Khane welcomed the recovery but questioned why it took widespread attention and community pressure to reverse a decision support had presented as final.

The episode is over but it depicts an uncomfortable reality of digital ownership: access to years of purchases and personal memories can hinge on a single company account.

A complaint from a Dutch streamer whose hijacked Microsoft account was permanently suspended has gone viral. The user claims to have lost access to his son's baby pictures and digital games that cost thousands of euros.

On Monday, Joshua Khane shared a customer support message from Microsoft stating that the company closed his account after determining that an unauthorized user had accessed it and changed its security details. Microsoft informed him that he would have to create a new account and repurchase all the games he had collected since opening his original account in 2001, the year the original Xbox launched. The company also claims to have deleted everything on Khane's OneDrive, as the cloud service's encryption prevents Microsoft from recovering its contents.

The streamer acknowledged that he had not enabled two-factor authentication and advised others to back up their data. Microsoft also recommends switching from passwords to passkeys.

Khane's tweet likely went viral because the incident occurred soon after Sony announced that it would cease manufacturing physical PlayStation discs from January 2028, forcing users to tie new game purchases to PlayStation Store accounts. The decision has drawn sharp criticism and led to lawsuits in the Netherlands and Mexico.

Although it occurred on Xbox instead of PlayStation, Khane's experience illustrates the risks of moving customers to digital storefronts. Microsoft is also expected to abandon physical discs when it launches its next console, codenamed Helix, in 2027 or 2028. However, a system for tying discs to digital licenses might debut for Xbox insiders as soon as this week.

It remains unclear whether Khane can sue Microsoft to reclaim his account, as one man in Brazil did just days ago. In that case, customer support informed the user that the initial automated message claiming his hijacked account was unrecoverable was almost identical to the one Khane received, and that Microsoft was still investigating. Despite fighting the lawsuit with a dozen lawyers, the company was ordered to restore the account, including all purchases tied to it, and pay $400 in damages.

Permalink to story:

 
So what you're telling me is that digital only stuff can be taken away from you?
no-god-please-no.gif


Also, why the hell are you keeping pictures on the cloud and only the cloud? I have 4 different spots I have pictures backed up and none of them are on the cloud.
 
This problem goes beyond cloud storage. I disabled my cell phone syncing to the cloud. A previous cell phone provider locked me out of my cloud storage and the use of my phone, simply because I was a pre-paid account, after years of being with them. There was no recourse, recovery or appeal, just gone!!! Had to switch providers and buy a new phone to regain cell phone usage. Should you lose access to your Pay Pal (and probably Venmo as they are Pay Pal) account, forget it. Pay Pal has zero recovery options to regain access, you are bluntly told to open a new account.

I store data locally and am very cautious of accounts in the cloud (I.e: Steam, Microsoft, Gmail...etc)!!!
 
"Microsoft took muh baby pics!"

I'll deride in advance all those so easily gaslit by a highly emotional, one-sided account of an evil corporation abusing a poor innocent. On nearly all occasions, "hacked" means you gave your credentials to someone, either directly through social engineering, or indirectly by foolishly downloading malware. What corporations *should* do in such cases would generate even more consumer ire -- charge a stiff "account recovery fee" for their costs in investigating the identity and true ownership of those involved, along with the legal liability they face if they guess wrong. It would easily come to several thousand dollars an incident.
 
“…Khane's experience illustrates the risks of moving customers to digital storefronts storing your data in a corporate-controlled/accessible cloud.”

FTFY. Dude should have learned over a decade ago. Cautionary tale. Keep things you care about on your own hardware. Back them up using appropriate methods YOU control. Don’t be a muppet.
 
Last edited:
Never store anything you can't afford to lose. "Baby pictures", really? Why was there no backups? For important stuff I usually keep 2 copies.
 
So what you're telling me is that digital only stuff can be taken away from you?
no-god-please-no.gif


Also, why the hell are you keeping pictures on the cloud and only the cloud? I have 4 different spots I have pictures backed up and none of them are on the cloud.

I have all family pictures and videos on 4 locations too
1. My wife's laptop.
2. Robo Copied to File Server nightly
3. File Server backed up locally to Backup System.
4. Backup System syncs with Back Blaze
 
Well, it looks like everyone skipped to shaming the guy because he wasn't techy enough with his backups. Couldn't be bothered to shame the giant corporation for ****ty customer service. Did everyone also miss the part where he had real money purchases on the account?


Could the guy have been more techy and backed up his photos? Sure. But that completely misses the point.
What sort of customer service is that where they don't even try to get the guy his services and purchases back??

Now, unless it comes out that the guy sold his account or something (not having 2 factor is extremely dumb but doesn't count), and is regretting doing so, I don't see why anyone would skim over MS's role in this just to whine about bad backup practices...
 
Some are really into cloud (actually someone else's computer as we all know) storage.
I've had a bad experience with...you guessed it...ONEDRIVE and stopped trusting the cloud.
I do use iCloud for iPhone photos but only as an intermediate before moving the pics to my PC.
An additional tip; BACK UP! Even local storage can break/die and a single point of failure is asking for trouble.
Hell one of my friends lost everything TWICE because he forked up his encrypted disks. Even the smartest people aren't exempt from making stupid mistakes.
 
Well, it looks like everyone skipped to shaming the guy because he wasn't techy enough with his backups. Couldn't be bothered to shame the giant corporation for ****ty customer service. Did everyone also miss the part where he had real money purchases on the account?


Could the guy have been more techy and backed up his photos? Sure. But that completely misses the point.
What sort of customer service is that where they don't even try to get the guy his services and purchases back??

Now, unless it comes out that the guy sold his account or something (not having 2 factor is extremely dumb but doesn't count), and is regretting doing so, I don't see why anyone would skim over MS's role in this just to whine about bad backup practices...
If he had two-factor authentication enabled, I think it would be fair to say Microsoft needs to do more to restore his account, but using any account with valuable data attached to it without two-factor authentication is just plain stupid. I'm sure he was prompted to setup two-factor several dozen times.

It is odd that Microsoft is so unwilling to be helpful, but if the guy never took the most basic step to protect his account I can't feel too bad for him.
 
If he had two-factor authentication enabled, I think it would be fair to say Microsoft needs to do more to restore his account, but using any account with valuable data attached to it without two-factor authentication is just plain stupid. I'm sure he was prompted to setup two-factor several dozen times.

It is odd that Microsoft is so unwilling to be helpful, but if the guy never took the most basic step to protect his account I can't feel too bad for him.
This is what we call a strawman. Yes, it was stupid of the guy to not have 2FA on an account with sensitive data, but that in NO WAY justifies Microsoft's behavior. It's not "odd", it is extremely scummy if not outright consumer hostile behavior. He is demonstrably a paying customer with legitimate data in the system MS is refusing to help him recover, despite paying for the service.

That is unjustifyable.
 
So if the user is not tech savy, it's HIS fault? Aha.. Not the corporation, nooo, it's the ***** trusting it?

two stories:
Story 1:
I lost my Twitch account due to hacking since I didn't enable 2FA. Two years ago. They did absolutely NOTHING to help. ZERO.
Although I provided the 1mbec1les at tech support over there not only the proof that I've indeed made the payments from my account, via the bank statements, and the provider name and IPs I used to log in from, I was willing to provide the national ID, passport, face etc to prove I really am me.
The result?
The "tech support" is a bunch of incompetent non native English speakers which are one of the most *****ic incompetent people possible.
The result? I lost the account.
Story 2:
Back in 2012 or so, I lost a Microsoft account due to losing the password and (obviously) not knowing the question: WHAT YEAR AND MONTH DID YOU CREATE YOUR ACCOUNT ON? WHAT?
Let me guess, I should trust Apple, Google, Microsoft and so on?
I should trust Sony to go full digital and NOT delete my games/whatever?
I should trust Ubisoft with my games, after they deleted The Crew from my library? Riiiiiight.
 
Not having 2FA enabled means that the account gets suspended until this is fixed.
Punishing the same paying user for not doing it is despicable.
Microsoft is a piece of vile sh!t.
Not for the things they did during all these years against the competition, but also for the AI training on user data and github.
Not paying for another Microsh!t console ever again.
Steam and Linux all the way.
 
I keep an internal copy of all my data, an external backup, and a second external backup that goes with me when I leave home. Very little of my data is in the cloud, but even that is also on those three backups.
 
My goodness, when do people learn to backup their data, especially baby pictures. This is 2026, not 1992. And, the only thing I would use a cloud service for, would be for NOTHING! Just get two 8TB external hard drives, (anything you want to keep, you put on both hard drives) use "EASE To Do FREE" backup software, create a back up every 24hrs, keep six days, and then prune one every day, and you're good. Yes, a external hard drive could fail, which is why two hard drives. I actually use three, one goes with me if I leave the house.
 
All of you are acting like there's more than ample "sense" in the form of common in this world.

When will people stop buying Microsoft crap, its the only way they will start pulling their head in!
 
Let me explain: unless you're rich you're not a human being.
At least....not to the people at Microsoft.

But then for the past few years they seem to hate their customers even the rich ones.
 
Back