Microsoft Called Khane’s OneDrive Lock Irreversible, Then Reversed It

Microsoft restored Dutch streamer Joshua Khane’s 25-year account on July 16, 2026, two days after a letter called the lock irreversible. Support had said OneDrive photos could not come back because of encryption. The pictures of his son returned with the login.

The same Microsoft identity held his Xbox library, Minecraft, and family files. A public post moved the case. The encryption story did not.

Microsoft Called the Lock Irreversible

Khane, a Twitch and Kick partner in the Netherlands, posted on July 14, 2026 after Microsoft closed the account he opened in 2001, the year the original Xbox shipped. He said unknown people took it over and changed the stored security information, and that support accepted he was the owner and that the account had been compromised.

The letter he shared still ended the identity. Microsoft said unauthorized access had occurred, then permanently suspended the account to prevent further misuse, calling the action irreversible and tying it to security policy and the services agreement.

https://x.com/JoshuaKhane/status/2076918699248803977

If he had used the account for Minecraft, the letter said the game could not be recovered and that a new purchase would be required on a newly created account. It also said OneDrive files were no longer accessible, and that encryption and data protection meant those files could not be restored. Khane said that cut him off from 25 years of data, thousands of euros in games, and his son’s baby pictures.

THE JULY LOCK AND RESTORE

1. 2001: Khane opens the Microsoft account the year the original Xbox launches.
2. July 14, 2026: He posts the support letter and says the company deleted the account and OneDrive after confirming the hack.
3. July 15, 2026: Xbox Support replies in public and says it has been working to restore access to his purchases.
4. July 16, 2026: Khane says the Microsoft account, the games, and OneDrive, including the pictures of his son, are back.

He told people who blamed him that security could have been tighter on his side and that lessons were learned. The part that bothered him, he wrote, was Microsoft saying it could not recover the account and then suspending it. Games, he added, were the piece he could not back up himself: he had relied on Microsoft to keep them safe even if he got compromised.

OneDrive Encryption Left Microsoft Holding the Keys

The letter treated encryption as a wall even Microsoft could not climb. Microsoft’s own OneDrive pages describe a different machine. Consumer files are encrypted so attackers and random staff cannot browse them, and so the service can still open them for the signed-in owner.

In transit, OneDrive uses TLS, with client connections established using 2048-bit keys. At rest, Microsoft says it uses a unique AES256 key for each file, then wraps those keys with master keys stored in Azure Key Vault. Data is mirrored into at least two Azure regions several hundred miles apart.

SharePoint and OneDrive documentation goes further. Each file is split into chunks, each chunk gets its own AES-256 key, and the map that puts a document back together lives in a separate database. Microsoft’s write-up of that design says the keys stored apart from the files sit in three places, and that any one of those stores is useless on its own.

WHERE THE KEYS ACTUALLY LIVE

• Blob store: File chunks sit as encrypted blobs spread across containers, each container with its own credentials.
• Content Database: A SQL database holds the map that locates those chunks and the keys needed to decrypt them.
• Key Store: Container credentials and related secrets sit in a separate store and are refreshed on a schedule.

That design stops a stolen disk from becoming a photo album. It does not put the only copy of the key in the customer’s pocket. For ordinary consumer OneDrive, Microsoft manages the cryptographic keys. Business tenants can add Customer Key and hold root keys in Azure Key Vault; that option is not how a personal streamer’s baby pictures are stored.

Microsoft also tells customers that OneDrive engineers work under a zero-standing access rule, meaning no engineer has standing access to the service. When access is approved, it is time-limited and scoped, and a distinct “Access to Customer Data” role is the one scrutinized most heavily. The privacy story is real. It is also a story about controlled access inside Microsoft, not a story in which the photos cease to exist the moment a support agent suspends a login.

A Public Reply From Xbox Support

The case moved when the post spread far beyond Khane’s own audience. On July 15, Xbox Support answered him in public, apologized, and asked him to check voicemail or inbox for next steps. The public wording was narrower than the loss he had described. It named purchases, not OneDrive and not the account itself.

https://x.com/XBOXSupport/status/2077401588394529030

That reply still changed the file. Days earlier, a Brazilian court had ordered Microsoft to restore another hijacked Xbox account, including the purchases tied to it, and to pay $400 in damages after a similar unrecoverable script. Khane’s letter had told him to create a new account and buy the games again. Xbox Support’s public note said the company was already working on the purchases on the old one.

Khane Called the Restore a Little Bit Shady

On July 16 he posted that Microsoft had reached out, then went live and said the account was back. “I’ve got all my stuff back, my games back, my Microsoft account back,” he said. “I’ve got my OneDrive back, and most importantly, I’ve got the pictures of my son, which I’m extremely happy about.”

He thanked the company and still described the path as ugly. The lock had been sold as a technical dead end. The files returned once the identity came back, which is what a service that holds its own keys can do when it chooses to reopen the account. Microsoft later restored Khane’s Xbox library and photos in full, after first describing the closure as permanent.

WHAT THE LETTER SAID, THEN WHAT RETURNED

He put the gap in one line. The company could bring the account back. The ordinary path was a refusal.

The way it all went, to me, is a little bit shady, because it’s not that they can’t bring back your account, they won’t bring back your account if you’re a nobody.

Joshua Khane, after the July 16 restore

He added that a company this large can bring an account back if you ask, and that his post blowing up was the difference. He called himself a nobody who got lucky on reach. That is a harder sentence than the encryption paragraph, because it matches what Microsoft actually did.

The Same Letter Still Goes Out

The trap is not mysterious. A thief who changes the primary email, phone, and recovery codes leaves the real owner holding receipts, old passwords, and a recovery form that then fails. Front-line support treats that failure as the end of the road, even when billing history and device lists still point at the same person.

On Microsoft Q&A in June 2026, weeks before Khane posted, independent advisor Darhyl Amizola told another customer there was nothing that can be done to recover an account once a hacker had modified the security information, and that Microsoft Support could not help either. The automated answer on that thread said that if the recovery form denies the request, there is no further escalation path, and that purchases and licenses stay tied to the locked identity.

That script is older than this case, and it did not retire when Khane got his photos back. Microsoft has a longer record of irreversible Xbox bans later reversed once a case leaves the ordinary queue. Khane’s letter was the same product, pointed at a confirmed hack instead of a conduct strike.

HOW THE LOCK STICKS

• Security swap: The attacker replaces email, phone, and codes, which breaks the self-service reset the owner still expects to use.
• Form failure: The recovery form is automated; a denial is treated as proof that ownership cannot be verified, even when purchase history exists.
• License glue: Games, Minecraft, and OneDrive stay bound to the suspended identity, so a new account starts empty.
• Public queue: Xbox Support’s working bypass, in this case, was a viral post plus inbox and voicemail, not the published recover-hacked flow.

People who answered Khane in the following weeks described the same mail, including owners who still controlled the original inbox and still got a closed door. In early September 2026, two months after his restore, new notes in that same thread still said the account was gone because the writer did not have an audience large enough to force a human review.

What Happens When a Hacker Changes Security Info

Microsoft’s published guide on how to recover a hacked Microsoft account starts with a full malware scan, then a password change or reset, then a sweep of forwarding and connected apps. That path assumes you can still prove the login. It is silent on the support letter Khane received, the one that closes the identity after a confirmed break-in.

A separate Microsoft explanation, repeated on Q&A, describes a 30-day pending state after security info changes, with mail to the old phone or email and a chance to cancel the request. If the attacker already burned those channels, that window does not hand the account back. The owner is then told to start over, which is also how Windows Backup, Xbox saves, and OneDrive collapse together, because they all sit on the same sign-in.

WHAT WE KNOW

• Confirmed break-in: Microsoft told Khane unauthorized access had occurred and still suspended the account.
• Full restore: On July 16 he said the account, games, OneDrive, and his son’s pictures were back.
• Managed keys: Consumer OneDrive encryption uses Microsoft-managed keys, so reopening the account reopens the files.

WHAT IS UNCONFIRMED

• Attack path: Khane did not publish a forensic write-up of how the thief got in.
• Policy change: Microsoft has not said the irreversible letter is retired for customers who never trend.
• Other restores: There is no public count of how many identical cases were reopened after July 16, or left closed.

Personal Vault adds another sign-in factor around a folder, and it still lives inside the same Microsoft account. If the attacker already passed that factor, the extra door does not help. If they did not, the vault is only as strong as the account that holds it.

Copies Microsoft Cannot Take With the Account

Two-step verification would have made the original takeover harder, which is why Microsoft puts it on the OneDrive safety list next to a strong password and backup contact methods. You turn it on from the Microsoft account Security tab under Manage how I sign in. It is not a spare copy of a baby picture. It is a second lock on the identity that owns the picture.

The copy that survives a lock is the one that never depended on that identity. An external drive, a second cloud under a different login, or a PC folder that is not the only OneDrive original will still be there if support mails the irreversible letter. Xbox purchases will not. They cannot be duplicated by the customer, which is the part Khane could not fix on his own and the part Xbox Support moved on first once the post spread.

OneDrive will let a signed-in owner pull files from the recycle bin for 30 days, and a Microsoft 365 subscriber can roll the library back across that same window after ransomware or mass deletion. Those tools need the account. They do not outlive a permanent suspend. Khane’s photos came back because Microsoft reopened the identity, not because a recycle bin outranked the letter.

Frequently Asked Questions

Why did Microsoft say Joshua Khane’s OneDrive files could not be restored?

The letter tied the loss to encryption, privacy safeguards, and the services agreement after a confirmed unauthorized sign-in. Consumer OneDrive uses Microsoft-managed keys in Azure Key Vault, while Customer Key, the option where a tenant holds the root keys, is a Microsoft 365 business feature. Reopening the personal account is enough, in that design, for the service to decrypt the files for the owner again.

How long does OneDrive keep deleted files?

Deleted files stay in the OneDrive recycle bin for 30 days unless they were emptied. Microsoft 365 subscribers can also use Files Restore to roll the whole library back to a point in that same 30-day window after ransomware, corruption, or mass deletes, but only while they can still sign in.

What if you turn on two-step verification and then lose the phone?

Microsoft says two-step verification always requires two forms of identification. If you forget the password you need two contact methods, and if you lose the contact method the password alone will not get you back in, with a wait that can run 30 days. That 30-day clock is a lockout after losing your own second factor, separate from the 30-day recycle bin on files.

Can Xbox games be moved to a new Microsoft account after a suspend?

Khane’s letter said Minecraft could not be recovered and that a new purchase would be required on a newly created account. Microsoft Q&A guidance says purchases and licenses stay tied to the original account when ownership cannot be re-verified. His games returned because the old account was reopened, not because the licenses were copied onto a fresh gamertag.

What is the first official step after a Microsoft account hack?

Microsoft’s recover-hacked guide says to run a full malware scan before you change the password, so a thief still on the PC cannot steal the new credentials. After a clean scan you change or reset the password, then check forwarding, connected accounts, and automatic replies, because those are the settings Microsoft resets when it believes someone else was inside.

Khane has his son’s pictures again. In early September 2026, people were still writing into that July thread with the same letter and no public reply.