Li Auto Owners in Russia Hit by Mass Master Account Thefts

Why the master account matters

The master account is the owner's main digital profile and works as the key to the car. It gives access to the Li Auto app, which controls locks, climate, the powertrain, smart features and safety systems.

Russian owners already reported a surge of account thefts last summer. Back then the cause was expired SIM cards registered through Esender in WeChat and tied to the owner's foreign passport; the master account is transferred to that SIM when the car is bought. This time, Rasskazov says, attackers target Esender itself, and accounts are taken even from owners whose numbers are fully paid up, using Li Auto's standard tools.

Ransom demands have fallen from 200,000–250,000 rubles last year to 35,000–45,000 rubles. Rasskazov described it as a conveyor built for volume rather than one-off blackmail. He sees three possible attack routes: brute-forcing passwords, theft of car owners' data in China, and owners voluntarily handing logins and passwords to dubious firms or individuals that install apps, localize software or reflash cars.

What the company and experts advise

Sinomach Auto says Li Auto will pay special attention to the problem. The distributor and the manufacturer are working on account protection and on restoring access for legitimate owners, including a procedure to verify owners and recover master accounts safely. One element is moving accounts from Chinese phone numbers to an email address. That system is already in place for 2026 model-year Li Auto cars, and Sinomach Auto promises to extend it to vehicles delivered officially and through parallel imports.

Rasskazov advises victims not to pay and to go to the police. He admits no guaranteed protection exists, but recommends checking which number the master account is linked to, changing the Esender password, never sharing SMS codes and noting any unusual behavior in the Li Auto app.