Hey there, unfortunately Bungie's policy is that account security is our own responsibility, only someone with the full login details to one of your existing accounts could have added an account to your cross-save. If you're saying they added it and then activated cross-save themselves, that would mean they had to know the logins and passwords to both your Steam and XBox accounts. You'd need to find out how someone got your logins and passwords or your accounts will not be safe, it is not possible to obtain your login name from Bungie.net or Destiny 2. Accounts can no longer be unlinked as of the 25th of March 2025, and Bungie will not forcibly unlink accounts under any circumstances.