In a nutshell: Microsoft locks customer accounts permanently following hacking incidents and deletes all cloud data without recovery options, raising questions about data protection and consumer rights in the digital age.
In July 2026, Microsoft permanently locked the Microsoft account of a Dutch user following unauthorized access and deleted all data stored on his OneDrive cloud storage. The case raises questions about data protection and usage rights, particularly because the user had purchased content over 25 years, which is now lost.
On 13 July 2026, streamer Joshua Khane received a notification from Microsoft customer service: his Microsoft account had been permanently locked after an unknown person gained access and modified security data. The account had been active since 2001, marking the launch of the Xbox console. As a result of the lock, Khane lost access to all digitally purchased game licenses from the past 25 years as well as all data in OneDrive cloud storage, including personal photos of his son.
Microsoft justified the irreversible deletion of OneDrive data by citing the encryption of the cloud service: recovery after account suspension was technically impossible, the company stated. The corporation asked Khane to open a new account and repurchase his games. Khane himself acknowledged that he had not enabled two-factor authentication. However, mere account takeover is typically not sufficient to justify the permanent deletion of all user cloud data.
The case occurs in a broader context: Sony announced that it will discontinue manufacturing physical PlayStation discs starting January 2028, forcing customers into exclusive digital game distribution. Microsoft is also expected to forgo physical media for its upcoming Helix console (planned for 2027 or 2028). This is happening while CISOs and compliance officers are increasingly documenting vulnerabilities in account recovery processes and data governance at major cloud providers.
A precedent comes from a case in Brazil: a user sued Microsoft after an identical automated lock of his hacked account. A Brazilian court ordered Microsoft to restore the account including all purchases and to pay USD 400 in damages – despite legal opposition from Microsoft’s legal department.
Source: www.it-daily.net · Published 18 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.