This gamer had to sue Microsoft to get his hijacked Xbox account back

Ripple effect: As Sony, and likely Microsoft, prepare to take their gaming businesses fully digital, more users may find themselves at risk of losing their purchases to account hijacking. In one case that could be a sign of challenges to come, a user only got their account back after taking Microsoft to court.

Redditor “Ordo_Liberal” recently claimed to have won back their compromised Microsoft account by taking the tech giant to court. The episode offers a useful playbook for dealing with the company’s customer support, and serves as a warning as gaming companies phase out physical media.

Ordo’s troubles began in April, when their Microsoft account was compromised despite having two-factor authentication enabled. It’s unclear whether the 2FA code arrived via email or the less secure SMS. Microsoft has been pushing users toward passkeys and away from traditional passwords for exactly this kind of risk.

Update on my last post “Microsoft deleted my acc and told me to buy my games again”. I sued their asses and won! They have to restore my acc with all my games + pay me 400$USD. Translation in comment.
by u/Ordo_Liberal in xbox

Microsoft’s customer support told Ordo that it had verified the account was stolen, but said it couldn’t restore it because the thief had already changed its security details. The company’s only offered solution was to close the account entirely, forcing the original owner to buy his games again, including Minecraft.

After Ordo contacted a lawyer, a follow-up message from Microsoft’s support team in Brazil, where the user lives, revealed that the earlier response had been automated and that the case remained under investigation. One commenter on the Reddit thread claimed to have received an identical message, signed by a support representative with the same name.

Interestingly, Ubisoft’s customer service handled the situation far more effectively. When the thief tried to hijack Ordo’s Ubisoft account by logging in through the compromised Microsoft account and changing its security details, Ubisoft simply asked for ID verification and restored the account within an hour of the support ticket being filed.

Ordo claimed Microsoft fought the lawsuit with 12 lawyers and a 300-page filing, and still lost. Under a ruling filed with case number 0811207-44.2026.8.19.0002 in Rio de Janeiro’s court system (TJRJ), the company has 15 days to restore the Redditor’s account and purchases or face mounting fines that could reach hundreds of dollars. Microsoft also owes Ordo roughly $400 in moral damages.

Filing the lawsuit cost Ordo nothing, thanks to Brazilian consumer protection laws that let public defenders take on cases like this at no charge. He joked that the only expense was $10 for a pair of pants, since he couldn’t file the claim while wearing shorts.

Consumer protection regulations could soon carry even more weight in the gaming industry: Sony has confirmed that starting in January 2028, new PlayStation games will be sold only in digital form. Xbox appears headed the same way – Microsoft’s next-gen console, reportedly codenamed Project Helix, is rumored to ship without a disc drive, though the company is said to be testing a disc-to-digital feature that would convert legacy physical discs into digital licenses.