The key facts

  • Attackers take control of the master account and demand a ransom to restore access
  • They now demand 35–45 thousand rubles, down from 200–250 thousand rubles in the summer of 2025
  • Sinomach Auto plans to move authorization from Chinese numbers to email

What is happening

Owners of Li Auto crossovers in Russia have faced a new wave of attacks on vehicle master accounts. After a hack, the car may partially lose functions: screens go dark, climate control stops working, and in some cases the vehicle cannot be started. This was reported by Autonews, whose publication is summarized by Kun.uz.

The criminals' scheme

Cybercriminals gain control of the master account, which effectively serves as a digital key for controlling the vehicle, and then contact the owner and demand money to restore access. At least 20 victims are known, but the actual number may be significantly higher. The peculiarity of the new scheme is that the attack targets accounts in the eSender service — it is through this service that owners use Chinese phone numbers when registering a master account. Moreover, even users who have paid for number renewal lose the ability to log into the system.

The ransom amount has decreased

The scammers now demand 35–45 thousand rubles to return an account. For comparison: during the first wave of such attacks, recorded in the summer of 2025, the ransom reached 200–250 thousand rubles. Sources do not report the reasons for the reduced demands.

The distributor's response

Li Auto's official distributor in Russia — Sinomach Auto — has confirmed the existence of the problem. According to the company, the Chinese manufacturer, together with its Russian partner, is developing mechanisms to protect accounts and restore access for legitimate owners. It is also planned to introduce a procedure for verifying vehicle ownership and to move authorization from Chinese phone numbers to email — a similar system is already in place on Li Auto vehicles of the 2026 model range. The timeline for implementing the new solutions has not yet been specified. Owners are advised to regularly update passwords, not share verification codes or master account details with strangers, monitor the expiration date of the Chinese number, and, if access is lost, contact customer support and document the situation.