Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
Unfortunately, that is correct since the hacker was able to replace the account's security info successfully.
Your only option is to undergo a security info change request for 30-days if you still have access to the account.
You may check this link for more information regarding security info change: https://support.microsoft.com/accounts-billing/manage/what-does-security-info-change-is-still-pending-mean#:~:text=You%20were%20the%20person%20who%20removed%20the%20security,these%20security%20proofs%20to%20complete%20the%20cancel%20request.
Moving forward, please check this link for more information on how to secure your account and to prevent hacking incidents: https://support.microsoft.com/accounts-billing/manage/how-to-help-keep-your-microsoft-account-secure
Best regards,
Darhyl