Hackers take control of Li Auto accounts and demand ransom from owners
Criminals are increasingly hijacking user accounts linked to Chinese carmaker Li Auto’s SUVs in Russia and demanding money to restore access. In some cases, the cars’ displays go blank, the climate control stops working or the vehicle can no longer be started. Li Auto’s official Russian distributor, Sinomach Auto, has also confirmed the problem.
The digital key has become a tool for extortion
Li Auto vehicles use an owner’s primary account, or master account, through which door locks, climate control, engine starting and various other functions can be controlled.
Criminals take over the account, change its login credentials and demand around €400–500 from the owner to restore control.
According to representatives of the Li Auto owners’ association, at least 20 victims are known, but the actual number may be higher.
Similar attacks occurred as early as the summer of 2025, but the ransom demanded then was around €2,000–2,500. The lower amount now suggests that criminals may be trying to target more vehicle owners at once.
The exact mechanism behind the attacks remains unclear. Stolen passwords, leaked personal data and cases in which owners have given third parties access to their accounts are being investigated as possible causes.
The problem primarily affects cars imported from China
Many Li Auto vehicles’ user accounts are linked to Chinese phone numbers. Outside China, owners often use virtual numbers, for example through the eSender service.
Registering the phone number in the owner’s name was previously considered sufficient protection, but criminals have now also managed to take over accounts linked to valid numbers kept in good standing.
According to Sinomach Auto, Li Auto is developing a new system for verifying owners’ identities and recovering accounts. As one solution, the manufacturer plans to move user accounts from Chinese phone numbers to email addresses.
This option is already available on 2026 model-year vehicles. The new safeguards are also expected to cover unofficially imported cars in future, but no precise timetable has been announced.
Could the same happen in Europe?
The case is also relevant to European car owners, as Li Auto vehicles imported directly from China are present in the European market.
If a car’s master account depends on a phone number from another country or a third-party service, restoring access may prove difficult. The situation is particularly problematic if independent service providers have been used to adapt the vehicle’s software.
However, there is no evidence that criminals have breached Li Auto vehicles’ control units. The cases reported so far involve user account takeovers, rather than direct technical hacking of the car.
The Li Auto case highlights one of the major weaknesses of connected cars: the ability to use a vehicle may depend on a digital account over which the owner loses control. Cars that rely on authentication systems intended for another market pose a particularly high risk.
