---
id: "CMP-202611-ciccer"
kind: "campaign"
aliases: []
title: "Li Auto electric car owners in Russia locked out of their cars and extorted after attackers re-register the car's expired eSIM and take over the owner account"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Li Auto", "fixed": [], "affected": "Li Auto smart EVs sold in Russia (models unknown)", "ecosystem": "vehicle"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-04T07:42:29+00:00"
updated_at: "2026-11-04T07:42:52+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-04T07:42:29+00:00"}]
---

# Li Auto electric car owners in Russia locked out of their cars and extorted after attackers re-register the car's expired eSIM and take over the owner account

Attackers are taking over the master user accounts of Li Auto smart EVs sold in Russia (grey-import exports). Using Li Auto VINs leaked in earlier data breaches, they find cars whose linked eSender eSIM number has expired, re-register the eSIM and the car to a new account, create a new master digital key, then lock the doors and engine and message the owner for a ransom (about $500-600 now; over $3,000 in a first wave in July 2025). Alexander Rasfairy, co-founder of a Li Auto car club, told autonews.ru at least 20 owners have confirmed hacks in this second wave, and the real number is likely higher (reported by Risky Business, 4 Nov 2026). Li Auto is reportedly aware and working on email-based master account registration so exported cars no longer need a Chinese phone number. Exact models and start date of the current wave are unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vehicle:Li Auto affected Li Auto smart EVs sold in Russia (models unknown) fixed ?

## How to check

You own a Li Auto car outside China (notably Russia) and its master account is tied to an eSender eSIM / Chinese phone number that has expired or lapsed. Signs of takeover: the Li Auto app no longer shows you as master user, a new digital key appears, doors or engine are locked remotely, or you get a message demanding payment to restore access. No other indicators published.

## Fix

Keep the eSIM / phone number linked to your Li Auto master account active and renewed; check in the Li Auto app that you are still master user and remove unknown digital keys. Do not pay the ransom; contact Li Auto or an authorised service centre to restore the account, and move to email-based master registration once Li Auto offers it.

## Timeline

- 2026-11-04T07:42:29+00:00 analyst

## Documents

- [describes] @campuscodi.risky.biz: -Hackers lock out and extort Li Auto EV owners in Russia
-Second refrigerator ha https://bsky.app/profile/campuscodi.risky.biz/post/3mzhtlxvqoc2f
- [describes] Risky Bulletin: Hackers lock out and extort Li Auto smart car owners in Russia https://news.risky.biz/risky-bulletin-hackers-lock-out-and-extort-li-auto-smart-car-owners-in-russia/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_