My son's Microsoft account was hacked

It looks like my son's gmail account was hacked and the hacker used that to hack his microsoft/xbox account. Within 7 minutes (while he was sleeping), he received emails about a new security code, a password change, adding new emails and phone numbers, then deleting his email and phone number. How does he get back in? He has the email address of the person that hacked it through his authenticator app and he is still logged into the xbox app on his phone.

:)