Osegi
Security·2 min read

Li Auto Master Accounts Stolen in Russia, Some SUVs Won't Start

A new wave of hijacked master accounts is hitting Li Auto owners in Russia. About 20 victims have lost access to digital keys, and attackers demand money.

A Li Auto SUV with a dark infotainment display, illustrating a car locked out after its digital key account was hijacked.
Image: vc.ru

A new wave of master-account thefts is affecting Li Auto (Lixiang) SUV owners in Russia. According to Alexander Rasskazov, co-founder of the Li Auto owners' club for Russia and the CIS, about 20 victims are known so far.

The account works as the car's digital key. After a breach, some owners lose control of the climate system, cannot turn on the display and cannot start the engine. The attackers then contact the owner and demand money. Sinomach Auto, the automaker's official distributor in Russia, has confirmed the account hacks.

A ransom for the account

One owner said he could not start his car and every screen in the cabin was dead. He managed to drive off with a physical key, but the system kept demanding that he log in to the account again. An attacker then got in touch and asked for 45,000 rubles to return the master account. The driver filed a police report.

This is not the first such wave. In summer 2025, 47 profiles were reported hacked, with criminals asking an average of 250,000 rubles to restore access.

Paid virtual numbers no longer protect

Back then, owners could protect an account by registering a number with the eSender virtual-number service, which covers China, Hong Kong, the US, the UK and Poland, in their own name using their passport. Now fraudsters are also taking over accounts tied to paid eSender numbers, so that measure no longer guarantees safety.

Sinomach Auto says Li Auto is working on stronger account protection and other ways to verify car owners. It is also migrating accounts from Chinese phone numbers to email addresses. The distributor has given no timeline.

For owners, the case shows how heavily a connected car depends on a single cloud account: when it is compromised, the vehicle itself can become unusable.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:li autolixiangaccount theftsinomach autoconnected carsrussia

More from this day

See all →

More in: Security

See all →