Why did 4 months of email disappear

It sounds like your Microsoft 365 email account may have been compromised, which can lead to suspicious activity such as the deletion of emails. Here are some steps you can take to address this issue:

1. Check for Compromised Account Symptoms: Look for signs of a compromised account, such as missing emails, suspicious activity in your Sent Items folder, or changes to your contacts. If you notice any of these symptoms, it’s crucial to act quickly.
2. Reset Your Password: Immediately change your password to secure your account. Ensure that your new password is strong and unique.
3. Scan for Malware: Use antivirus software to scan your devices for malware that may have contributed to the compromise.
4. Review Inbox Rules: Check for any suspicious inbox rules that may have been created to forward or delete emails automatically. You can use PowerShell commands to check for hidden rules if needed.
5. Notify Your Email Administrator: If you're part of an organization, inform your email administrator about the situation. They may need to take additional steps to secure your account.
6. Investigate Further: Utilize the Microsoft Entra admin center and Microsoft Defender portal to review sign-in logs and audit logs for any unusual activity.
7. Restore Missing Emails: If emails have been deleted, check your Deleted Items folder or any other folders where they might have been moved. Depending on your organization's retention policies, it may be possible to recover some of the lost emails.

Taking these steps can help you regain control of your account and potentially recover your missing emails. If the problem persists, consider reaching out to Microsoft Support for further assistance.

References:

• Common symptoms of a compromised Microsoft 365 email account
• Respond to a compromised cloud email account

Hi Carolyn Decker,

Thank you for posting your question in the Microsoft Q&A Forum.

I understand that you are experiencing an alarming issue where emails seem to disappear when you delete others. This behavior is often a classic sign of a Compromised Account where a hacker has set up a malicious Inbox Rule to manipulate your mailbox.

May I ask if your account is a Personal account (Outlook.com/Hotmail) or a Work/School account? The steps below are prioritized for personal users to secure the account immediately.

Step 1: Secure Your Account Immediately

1. Change your Password: Do this immediately to lock out any current unauthorized access.
2. Sign Out Everywhere:
   • Go to account.microsoft.com/security.
   • Select "Manage how I sign in".
   • Scroll down and click "Sign out everywhere". This forces every device (including the hacker's) to log out within 24 hours.
3. Check Sign-in Activity for any unrecognized attempts: See when and where you've used your account

Step 2: Check for Malicious Rules

This is the most likely cause of your issue. The hacker likely created a rule to move or delete your mail automatically.

1. Log in to Outlook.com on a computer.
2. Go to Settings (gear icon) > Mail > Rules.
3. Look for any rule you did not create. Hackers often name them single characters like ., ..., or use blank spaces to make them hard to see.
4. Delete any suspicious rules immediately.
5. Check Forwarding: Go to Mail > Forwarding to ensure your email isn't being silently sent to the hacker's address.

Step 3: Recover Your Missing Emails

If the emails were deleted by the rule, they are likely in a hidden recovery folder.

1. Go to your Deleted Items folder.
2. Click at the very top of the list on the link that says: "Recover items deleted from this folder".
3. Select the emails you want to save and click Restore.
   • Note: Items in this recovery folder are typically available for 14 to 30 days after deletion.

Step 4: Check Other Folders

Sometimes hackers move email to folders like "Archive," "RSS Feeds," or "Conversation History" instead of deleting them. Please expand all your folders to check if your mail is hiding there.

The initial response might not address the problem. So, if your problem persists or you need any assistance, feel free to ask me by clicking "Add Comment". Thanks for your effort.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best regards.