I have two email accounts. My main one that I created a few years ago and switched to, which has a very strong/unique password that is not written down or stored anywhere. It also has 2-factor auth enabled. I have an older email account that I haven't used in years, but kept around since my Paypal account is linked to it. I forward all the emails from my old account to my new one.
A few days ago I received an email from Microsoft saying that there was a new access to my old email account. I reviewed the activity and after confirming that it was indeed not me, I immediately recovered the account, changed the password and added 2-factor auth for this one as well. The email from Microsoft said that the account was locked down, and that access to my inbox, contacts and calendar was blocked until I verified it.
This is an old account that I haven't used in years, there aren't any important accounts associated with it other than my Paypal account. I logged into Paypal, reviewed my details, history, nothing has changed, no payments have been made.
I changed my Paypal password, but since it was still the same one I presume that the attacker didn't try to recover it - the message from Microsoft said that my inbox was blocked as soon as he tried to login, if this is true then he wouldn't have been able to receive the password reset email at all.
What's my next step? I want to believe the Microsoft email and think that my inbox was locked and thus the attacker wasn't able to get anything out of my account, but a part of me doesn't want to take any chances.
I recently started using a password manager and changed a few dozens password on all the website I frequently use, and I use different passwords for my bank website, Paypal and my main email address - none of which are in the password manager.
Does anyone else have experience with a breached Microsoft account? Could the attacker do more damage than I think? Are there some things I need to watch for?
Any advice would be really appreciated.