Li Auto owners in Russia report mass theft of master accounts and vehicle blocks

Owners of Chinese Li Auto (Lixiang) vehicles in Russia have reported a wave of mass master account thefts, according to industry reports and official distributors. As a result of these cyberattacks, the affected cars cannot be started, cabin screens go blank, and the climate control along with various safety features become entirely disabled.

• The master account acts as the primary digital key to manage the vehicle via the official mobile application.
• At least 20 victims of this sophisticated scam have been identified so far by car club representatives.
• Hackers have reduced their ransom demands to 35,000–45,000 rubles, shifting toward a high-volume extortion model.
• Security experts link the vulnerability to Esender virtual SIM services and leaked insurance databases.

How the scheme operates

The Li Auto master account serves as the central digital profile used to control door locks, engines, entertainment systems, and intelligent safety features. Once attackers gain control over the master credentials, they lock legitimate owners out completely. Experts explain that fraudsters primarily target the Esender service, which manages the Chinese virtual phone numbers linked to imported vehicles during registration.

According to automotive club representatives, vulnerabilities are exploited through brute-force password attacks, data leaks originating in China, or instances where vehicle owners voluntarily handed over credentials to unauthorized third-party services offering software flashing and localization. Fraudsters reportedly track vehicle VIN numbers through compromised insurance databases leaked online.

Manufacturer response and security measures

Distributor Sinomach Auto announced that Li Auto is taking the issue very seriously and is actively working with the manufacturer to establish enhanced account protection mechanisms. The companies are developing secure account recovery procedures, including transitioning user profiles from Chinese phone numbers to standard email addresses—a system already implemented for 2026 model year vehicles and soon to cover parallel import units.

Experts strongly advise affected owners against paying the ransom and recommend filing reports with law enforcement agencies. To minimize risks, drivers are urged to update their Esender passwords, keep SMS verification codes strictly confidential, and monitor the official Li Auto application for any unusual activity.