A hacker locked away 25 years of Microsoft data — here's why self-hosting matters

Microsoft recently faced an uproar after a hacked 25-year-old account was permanently suspended, apparently cutting its owner off from decades of files, photographs, and game purchases. Microsoft ultimately restored access after the case gained widespread attention, but the incident exposed how much of our digital lives now depends on decisions made by third-party providers.

25 years gone with one deletion prompt

And the account was gone just like that

A quarter of a century is a long time. It’s also an exceptionally long lifespan for an online account. One man owned a Microsoft account for 25 years and suddenly lost access to decades worth of photos, files, game purchases, and other stored data. The Dutch streamer, Joshua Khane, revealed that a malicious party took control over his Microsoft account, which was created in 2001.

This attack saw the password changed, and all security information was altered, effectively locking Khane out of the normal Microsoft account recovery process. It's the worst kind of attack, as there's essentially no reversing this without Microsoft's direct intervention, and all your personal data stored on the company's servers is at risk. Microsoft permanently suspended the account following the unauthorized access. That may have prevented further misuse, but it also left Khane locked out of the account and everything connected to it.

According to Khane, this decision cut him off from all his Xbox purchases. OneDrive files were inaccessible, and photos were lost to the online world. Discussion around this move quickly turned from attempting to provide support to how data is stored and provided with these third-party subscriptions and accounts. Whether we truly control data stored in the cloud is a question many NAS owners and self-hosters confront before bringing their files home.

Microsoft did end up restoring access to the account. After the case attracted considerable attention on social media and from news outlets, Microsoft reversed course and restored Khane’s access. That's it, a positive ending and case closed, right? Not quite, because if this case didn't garner the attention and support Khane was so fortunate to have received, Microsoft may not have restored access, and if no backups were made, he'd be out of luck.

This isn't proof that cloud services are bad

But you must secure your accounts properly

I wish I were joking when we covered the fact many people still to this day use "password" and "password123" to secure accounts. At the very least, use a password manager like Bitwarden that can help provide secure, random passwords that are tied to each account. Using a unique password for every account also limits the damage if one service is breached. An exposed password cannot simply be reused to access your other accounts.

Cloud subscriptions and services can be affordable, convenient, and useful even if you already self-host. Cloud storage can be particularly useful for stashing backups and off-site copies of data. The risk with these services comes when they are solely used for storing a single copy of data, but the same goes for an external hard drive or USB drive at home. If you don't have a backup strategy in place, you're running the risk of encountering a similar situation.

Then there's gaming. Buying games digitally through Microsoft, Sony, Nintendo, and even Valve can be extremely convenient. The majority of my PC game library is with Steam. If I lose access to that account, I better hope Valve will provide me with access since I've spent a small fortune over the last decade or so. There's no getting around this other than buying physical copies or ensuring you have the means to run digital versions without storefront access — GOG is great for this.

Better account security reduces the likelihood of this happening, but it cannot remove the underlying dependency. Even the strongest password and passkey leave the provider in control of its platform. That is where local copies, independent backups, and self-hosted services become important. If you're done with relying on others to handle everything, it may be time to start taking back a little control.

Where self-hosting and NAS can lend a helping hand

From stashing away all your data to replacing Microsoft Office

Self-hosting can mean pretty much anything. It could be as simple as running Plex to stream purchased media or as expansive as running a self-hosted empire with productivity suites, online cloud storage, websites, synchronization, email, and game streaming. So long as you can think up an idea, there's usually a container or some package that can make it a reality. Self-hosting simply means you own and run the infrastructure and data.

If your internet connection goes down, locally hosted services can remain available across your home network. You also avoid losing access because a provider’s platform, authentication system, or subscription service is unavailable. But on the flip side, you're now responsible for running a micro-datacenter at home. If something goes wrong, you will have to answer the support tickets fired in from family members. But thankfully, it's not impossible to configure, and prebuilt NAS from Synology, Asustor, TerraMaster, and others make it incredibly easy.

But if you did want to get a little creative, all that's required is a small and compact mini PC, a copy of Proxmox, and some time to learn how virtual machines (VMs) and Linux containers (LXCs) work on top of a hypervisor. If you already have an old PC and suitable drives, you may be able to begin with very little upfront expenditure.

When self-hosting makes more sense over cloud

Ask yourself some questions about the services you rely on. Can you export all the data in a format that can be used elsewhere? Do you have multiple copies available? Can you restore the data without needing to go through the service provider? And finally, can you move everything to a competitor or self-hosted service? If the answer to all four questions is no, that service should be near the top of your list for an export, an independent backup, or eventual replacement.

Self-hosting and using a NAS can also be a great way to save money. Many online services require a subscription to get the most from them. This is especially so with cloud storage and media streaming. If Netflix or Amazon Prime Video removes a movie or series, you'll lose access to this content without getting a discount on your monthly fee. If you own this media and can stream it locally, you'll always have access. The same goes for data. You're only limited by drive capacity.

Backing up should be part of our modern lifestyle, but it's still often overlooked. We recommend following a 3-2-1 strategy, which sees three data copies stored on two devices and one kept off-site. For my NAS, I have a full backup stored in another location at home, as well as one in cold storage somewhere in another country. This substantially reduces the chance that a hardware failure, theft, fire, or account suspension could destroy every copy at once.

It’s worth stressing that a NAS is not automatically a backup. RAID can keep a system running after one drive fails, but it will not necessarily protect you from accidental deletion, ransomware, corruption, theft, fire, or a bad software update. Synchronization is not backup either: if a file deletion is synchronized to every device, all you have created is several copies of the same mistake. Be mindful when configuring your data protections.

You'll find plenty of features and guides right here on XDA, ranging from setting up home lab dashboards to full video game streaming services. A word of warning, however: setting up self-hosted services can be quite the rabbit hole. Be prepared to invest a lot of time in perfecting your stack.

Own your recovery path and save your data

Khane had his account ultimately restored by Microsoft, but it was likely quite the wake-up call for the Dutch streamer. He was also very lucky, and not everyone may receive the same outcome, which is why you shouldn't blindly trust the likes of Microsoft, Google, Apple, or some other provider. Maintain multiple copies of stuff you couldn't bear to lose. Self-host anything that would cause the most damage should it be revoked or removed. Decide on a healthy mix of cloud and self-hosting or become a hermit like myself.