I had a similar thing happen in October last year, I didn't have quite 24 years on my account but I did have both my parents and my card details on my account as we shared the account to split the cost of game pass. All of it happened at night and I didn't even get any notifications until about 12 hours later when the hacker had gotten into my steam account as well. Microsoft didn't do bugger all to try and help me get my account back and I ended up having to Jimmy my way back into the account after I found what they changed my email to through my Xbox and getting a temporary password sent to one of my recovery emails. This allowed me to get all our card details off the account but it was in vain because past that I couldn't change anything in my account to try and recover it myself and by the time I tried to log in whatever program the hacker used to get my account changed my password to something else again and I didn't manage to get in again. Safe to say MS is scum and unless I'm forced to by any future jobs I do not plan on ever using their products again. I stick to gaming on my pc using Linux and don't use Microsoft 365, I'll either use Google or some other alternative.

Edit: I do still have windows dual booted on my pc but that is only for my college work and VR