Microsoft Restores Streamer Joshua Khane’s Hacked Xbox Account

Microsoft restored a hacked streamer’s account and 25 years of data on July 16, two days after telling him the shutdown was permanent and could not be undone. Dutch Twitch streamer and Xbox player Joshua Khane says a hacker rewrote his account’s security information, and Microsoft’s own support team confirmed the takeover but initially said the damage could not be reversed.

The reversal arrived only after his account of the ordeal drew millions of views online. Whether a quieter user without that reach gets the same phone call is the question the case leaves open.

Security Info Changed, Then the Door Sealed Shut

Khane says the trouble started when an unknown attacker gained access to his Microsoft account and swapped out its stored security information, the details Microsoft uses to verify who owns an account. He posted about the takeover on X, writing that Microsoft had deleted his account and OneDrive.

Microsoft support later confirmed, in writing, that unauthorized access had occurred. But the company said its security policies and service agreement meant the hacker’s changes to the security info could not be rolled back. To stop further misuse, Microsoft blocked the account outright and described that decision as final.

That single call carried weight far beyond a locked login screen. The same account gated Khane’s OneDrive storage and his entire Xbox purchase history, and Microsoft said none of it could follow him to a fresh account.

Thousands of Euros in Games Frozen With the Photos

Microsoft told Khane the content in his linked OneDrive could not be restored because of the encryption and data protection built into the service, the same mechanisms meant to keep strangers out now kept the rightful owner out too. For Khane, that meant roughly 25 years of stored files, including photos of his son as a baby.

The account also held his Xbox digital library: several thousand euros (several thousand dollars at current exchange rates) in games and other purchases, by his account. Among them was Minecraft, which Microsoft’s letter said could not be transferred to another account, leaving a game he had already paid for stuck behind a locked door with everything else.

How Two Days of Public Pressure Changed Microsoft’s Answer

Khane’s post did not stay small. It reached millions of views within days, and the story spread through gaming outlets and tech forums well past his own following.

The following list traces how the case moved from a quiet support ticket to a public reversal.

1. July 14, 2026: Khane discovers his Microsoft account has been suspended after a hacker altered its security information, and posts about it on X.
2. Shortly after: Microsoft support confirms unauthorized access took place but says the altered security info cannot be reverted under its policies.
3. Within days: The account is permanently blocked; OneDrive files and Xbox purchases, including Minecraft, become inaccessible, with Microsoft calling the block irreversible.
4. As the post spreads: Xbox Support responds publicly on X, apologizes, and says a fix is underway.
5. July 16, 2026: Khane confirms Microsoft has restored his account, Xbox library, and OneDrive photos.

Xbox Support’s public reply came directly under Khane’s post:

We’re sorry this happened, it’s not the experience we want anyone to have when their account is compromised.

Xbox Support wrote the message on X, adding that next steps had been discussed directly with Khane.

What Microsoft Said Versus What It Did

The gap between Microsoft’s written verdict and its eventual action is the clearest measure of what changed, and it did not come from a new piece of evidence. It came from attention.

Khane welcomed the outcome but pushed back on how it happened, telling reporters the whole process felt a little bit shady and questioning why a decision his support ticket called irreversible only moved after his post went viral. Microsoft has not issued a detailed public statement explaining what changed internally between the original block and the July 16 restoration.

Why Can’t OneDrive Data Just Be Restored?

When a Microsoft account gets fully reset by an attacker, the encryption keys tied to that account’s identity are what stand between a stranger and your files, and Microsoft’s own support channels say that once those keys and security info are completely replaced, there may be no technical path back regardless of who is asking.

Microsoft’s community support forum is full of nearly identical stories. One user describes an attacker who fully replaced the security info and aliases on their account, only for moderators to confirm that once ownership can no longer be verified through the system, the standard advice becomes starting over with a brand new account. Microsoft’s own recovery guide walks users through the verification steps that are supposed to prevent exactly this outcome.

The scale behind these individual threads is large. Microsoft has said identity-based attacks, most of them still built on stolen or sprayed passwords rather than anything more advanced, surged 32% in the first half of 2025, according to corporate vice president Amy Hogan-Burney. That single number means Khane’s case is not a one-off glitch. It is one visible example of a much larger, mostly invisible pattern.

Microsoft has been tightening account and disk-level security elsewhere in 2026 too, including a move to close a BitLocker recovery bypass after new workarounds kept surfacing. The same encryption built to keep attackers out is the layer that, once an attacker gets past it first, can lock the real owner out just as completely.

Protecting an Account Nobody Else Is Watching

Khane got his files back because millions of people saw his post. Most users do not have that option, which makes basic prevention the only real safety net.

• Turn on two-factor authentication through an authenticator app rather than text messages alone, so a stolen password isn’t enough on its own.
• Keep a second copy of irreplaceable photos and documents outside OneDrive, on an external drive or with a different provider entirely.
• Review your account’s security info periodically so an unfamiliar recovery email or phone number gets caught early, not after a full takeover.
• Save your account recovery details somewhere separate from the inbox tied to the account itself, since a hacker who owns that inbox owns your recovery path too.

Microsoft has drawn hard lines on other deadlines this year that it did not walk back even under pressure, including turning Office 2019 for Mac read-only after a 2023 support promise expired. Khane’s case shows those lines can bend, but so far only for accounts attached to a large enough audience.

Frequently Asked Questions

Is Joshua Khane’s Microsoft Account Fully Restored Today?

Yes. Khane confirmed on July 16 that Microsoft returned his Xbox library, OneDrive files, and his son’s photos. Microsoft has not publicly detailed what changed internally to allow the reversal, and there has been no public mention of compensation beyond the restored access itself.

Does This Happen to Other Microsoft Users Too?

It does, regularly. Microsoft’s own community support forum carries dozens of threads from 2026 alone describing hacked accounts where security info was fully replaced, with moderators confirming the account could not be recovered through standard channels, well before Khane’s case made headlines.

Why Couldn’t Khane Move His Minecraft Purchase to a New Account?

Minecraft and most Xbox digital purchases are licensed to the specific Microsoft account that bought them, not to the person. That is why the block cut off the game entirely instead of simply requiring a fresh login.

Does Two-Factor Authentication Stop This Kind of Lockout?

It stops most takeover attempts, but not all of them. If an attacker already has a foothold, such as access to a recovery email, they can sometimes add their own authenticator or phone number as new security info, which locks the real owner out from the inside.

What Is the Safest Way to Back Up OneDrive Photos?

Security specialists generally recommend three copies of anything irreplaceable, kept on two different types of storage, with at least one stored offline or with a separate provider, so a single locked account can never erase every copy at once.