Hackers hijack Li Auto owners' accounts in Russia and demand ransom to unlock the cars

Owners of Li Auto crossovers in Russia are losing control of their cars to hackers who steal the "master account" that links each vehicle to its owner, then demand money to give it back. At least 20 owners have been hit in the latest wave, according to Alexander Rasskazov, co-founder of the Lixiang owners' club for Russia and the CIS, CNews reported on 3 November. Some of the cars no longer start. Sinomach Auto, Li Auto's official distributor in Russia, has confirmed that the accounts are being stolen.

What happens to the car

For a Li Auto, the master account works as a digital key: it is the owner's main profile in the brand's app, and most of the car's functions are tied to it. Once it is taken over, the screens go dark, climate control stops working and the Bluetooth key no longer responds. In some cars the engine will not start at all. One owner managed to drive off using the physical key, after which a message in Chinese appeared on the screen asking to "activate" the vehicle. In other cases the car simply disappears from the owner's profile.

Then comes the ransom demand. Owners are asked for 35,000 to 45,000 rubles to get their account back. During the first wave, in the summer of 2025, the price was 200,000 to 250,000 rubles. Rasskazov describes the new campaign as a "conveyor" built for volume rather than one-off blackmail, Habr quotes him as saying. Some victims have already sent documents to Li Auto in China, but none has got access back so far.

How the accounts are stolen

Li Auto accounts are tied to Chinese phone numbers. Many Russian owners use the eSender service, which provides such numbers, to keep them. In the first wave, attackers took over accounts linked to expired numbers. Back then the advice was to keep the eSender number paid, but now accounts with paid numbers are being stolen too, and according to Rasskazov "everything happens through Li Auto's standard tools". So this is an account takeover, not a hack of the car's onboard computer: the attackers use the same account functions as the owner.

Exactly how the attackers get in is not known. Rasskazov sees three possible routes: guessing passwords, theft of owners' data in China, and owners themselves handing logins and codes to unofficial workshops that install apps, translate the interface or reflash the car. He believes the attackers find their victims by looking up VIN numbers in leaked insurance databases.

What Li Auto promises

According to Sinomach Auto, Chinese specialists are handling the complaints, and Li Auto and the distributor are developing account protection and a procedure to verify legitimate owners. "Work is under way on a procedure for 'migrating' accounts from Chinese phone numbers to email addresses," the company said, adding that this kind of login is already in place for 2026 model-year cars. The fix is promised both for officially supplied cars and for parallel imports, Anti-Malware.ru writes. No deadline has been given.

What owners can do

• Check which phone number your master account is tied to, and change your eSender password.
• Never pass SMS codes or account logins to anyone, including workshops that offer to translate or reflash the car.
• Keep the physical key with you: in at least one case it let the owner drive despite the hijacked account.
• Note any unusual behaviour of the app, such as unexpected logouts or new devices, and contact the dealer straight away.
• If the account has already been taken, do not pay: Rasskazov advises going to the police, and payment does not guarantee that access will be returned.

The problem goes beyond one brand. When a car is controlled through the manufacturer's cloud, a single stolen login can switch it off, and the owner has to rely on a support service that may be in another country. Before buying such a car, it is worth asking how the account is recovered and what still works without it.