both my hotmail accounts had their passwords changed overnight

Something else - the recovery form has a daily limit, around two tries a day. If the first one gets rejected, collect more details (old passwords, exact email subjects) before you send another rather than retrying straight away. And change any other account that used that same password. Whoever did this will try it everywhere.

Both at once usually means they shared a password, or the same device got hit. Before you recover anything, run a full malware scan on the computer you normally log in from, otherwise you're handing them the new password too. Then from a clean device go through Microsoft's account recovery for each one. Once you're back in: - check recent activity - remove any recovery email or phone number you don't recognise - sign out of all sessions - look at inbox rules and forwarding - attackers love adding a rule that quietly forwards everything - turn on two-step verification And give each account its own password this time.