Owners of Li Auto cars in Russia are being shut out of their own vehicles by hackers who want about $500 to restore access, a ransom scheme first reported in Russian media in early November. At least 20 owners have confirmed the attacks, and the true count is likely much higher. Dashboards go dark, climate control stops, and in some cases the engine will not start.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The demand has fallen sharply since the first wave in July 2025, when attackers asked for more than $3,000.
The master account as a ransom lever
Li Auto’s smart cars rely on a master digital account that replaces the physical key, controls locks and engine start, and runs the official app. Risky Business News described the method: attackers take leaked vehicle identification numbers, find expired Chinese eSIM numbers tied to Li Auto accounts, re-register them, then move the cars to new accounts, which creates a new master digital key. The doors and engine lock, and the attacker contacts the owner to sell back access.
Most affected owners had registered master accounts with Chinese eSIMs from the eSender service or from the importers who brought the cars to Russia. A Chinese phone number is the weak point, because the numbers lapse and can be recycled.
What Russian outlets reported, and where accounts differ
The Russian reporting adds color and caveats. SecurityLab reported on Nov. 2 that an owner of a Li Auto L7 lost the electronic dashboard on Oct. 28, and that demands now run 35,000 to 45,000 rubles, down from 200,000 to 250,000 rubles in summer 2025. One driver was asked for 45,000 rubles about ten minutes after the Bluetooth key stopped working.
Not every report agrees on the mechanism. SecurityLab said the compromise method was not yet established and listed password guessing, credential theft and owners sharing access codes with third-party services as hypotheses, and it noted this wave hit accounts with active, paid eSender numbers. Mentoday reported on Nov. 3 that experts suspect VINs from leaked insurance databases and physical Chinese SIM cards.
Alexander Rasskazov, a co-founder of the Lixiang owners’ club in Russia and the CIS, confirmed 20 cases to Russian media and said the real number of victims is higher. Risky Business News attributes the same count to a car-club founder. Rasskazov added that accounts are now being taken over even for owners who pay for eSender, using Li Auto’s own tools.
The victims’ accounts show how abrupt the lockouts are. One L7 owner’s instrument panel went dark as the car left a parking garage; after a reboot a Chinese-language activation QR code appeared and the vehicle had vanished from the app. Another owner was logged out of the app and found, in the eSender history, SMS requests to change the registered number. That car still ran, but the number had been changed and the family account detached. Expert Maxim Kadakov told Za Rulem that some owners hand over account data themselves, for example when third parties offer to help pay for the Chinese phone number tied to the account.
The price has been drifting downward in rubles as well as dollars. SecurityLab put summer 2025 demands at 200,000 to 250,000 rubles and the current demands at 35,000 to 45,000, which is the local-currency counterpart of the $500-$600 range Risky Business News gives. A lower price suggests the attackers want volume: a cheaper ransom is easier for a stranded owner to pay quickly, which is how one victim ended up being quoted a figure minutes after losing the key.
Li Auto, Sinomach and the planned email fix
Li Auto’s official Russian distributor, Sinomach Auto, confirmed the problem and said it is working with the manufacturer on verification and recovery procedures. Li Auto is reportedly developing a way to register master accounts with email addresses, which would remove the dependence on a Chinese phone number for exported cars. Mentoday notes that 2026 model-year cars already carry the mechanism and that no patch date has been announced for the rest, including parallel imports.
The reports draw one important boundary. Nothing in them confirms that attackers reached onboard software or could control a car while it was moving. The harm described is lockout and extortion.
Risky Business News frames the episode as part of a larger pattern in which connected cars turn account takeover into physical lockout. Here the attackers did not need to touch the vehicle; a phone number tied to an unrenewed Chinese SIM was enough, which is why the proposed email-based registration is more than a convenience for owners of exported cars.
Earlier history shows the pattern repeating. Habr covered the first wave of hijackings in July 2025, and the second wave was reported in early November 2026, with the ransom lower and the technique adapted. Advice from the distributor and experts is to avoid paying, since payment does not guarantee control returns, to document the breach with screenshots, and to contact police. The question still open is when Li Auto will ship email-based verification to the cars already on Russian roads.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
