Li Auto crossovers face massive master account hacks in Russia

Russian owners of Li Auto crossovers have encountered a massive wave of cyberattacks where master accounts of vehicles are remotely hijacked. Following the attacks, drivers lose control over key digital features of their cars, while scammers demand financial ransom to restore access.

• A massive wave of master account hacks targeting Li Auto crossovers has hit Russia.
• Cybercriminals demand between 35,000 and 45,000 rubles to restore access to the digital keys.
• Official distributor Sinomach Auto and Chinese developers are currently working on new security mechanisms.

How the master account compromise operates

The master account in Li Auto vehicles serves as a full-fledged digital key, allowing owners to manage the mobile app, climate control, door locks, and smart features. Losing access to this account severely restricts normal vehicle operation and basic driving capabilities.

According to Alexander Rasskov, co-founder of the Lixiang owners club in Russia and CIS countries, at least 20 victims are known, but the real number could be much higher. Attackers reportedly locate owners via VIN numbers through leaked insurance databases before hijacking accounts.

Possible breach vectors and official response

The exact hacking vector has not yet been precisely identified, but experts consider password stuffing, user data leaks in China, or voluntary transfer of login details and SMS codes to third-party specialists dealing with vehicle firmware and Russification as likely causes.

The official brand distributor in Russia, Sinomach Auto, has confirmed the issue. Together with Chinese specialists, they are developing account protection and recovery mechanisms, including shifting authorization from Chinese phone numbers to email addresses.

Recommendations for owners and broader context

Owners are strongly advised to ensure their master account is linked to a phone number registered under their passport, change passwords, and never share SMS verification codes. If access is lost, victims should take screenshots and contact police while avoiding ransom payments.

Notably, a similar scam occurred last summer when extortionists demanded between 200,000 and 250,000 rubles. The drop to smaller ransoms of 35,000–45,000 rubles indicates the scheme has scaled into a mass operation aimed at high-volume, lower-cost payouts.