A multi-nation digital billboard hack struck outdoor advertising networks in Egypt, Malaysia and Brazil on Thursday, broadcasting explicit adult videos across prominent roadside electronic screens. An online collective claimed responsibility after using an automated scan to locate and breach internet-connected software systems that control municipal and commercial displays.
Key points
- Attackers breached digital advertising networks across multiple countries simultaneously to broadcast sexually explicit videos on public roadside screens.
- Major incidents occurred along a primary highway in Giza, outside shopping districts in Johor, and on an avenue in northeastern Brazil.
- The group behind the attack said it used a simple two-hour automated internet scan to find unauthenticated transmission software interfaces.
- Authorities and advertising firms have switched off the breached screens and initiated criminal investigations into the compromised infrastructure.
How the digital billboard hack unfolded
Motorists on the 26th of July Axis in Giza, a major thoroughfare linking Cairo to Egypt’s western suburbs, halted traffic on Thursday when an electronic billboard began displaying pornographic footage. The broadcast displayed text attributing the breach to a group using the Telegram handle Leakers$, alongside four individual pseudonyms. Egyptian media and regional monitors reported that drivers left their vehicles to record the disruption before authorities intervened.
Egypt’s Interior Ministry said the compromised screen belonged to advertising agency Al Arabia United, an Egyptian-Saudi joint venture that manages roughly 239 digital billboards across the country. According to the ministry, the local firm contracted an international technology provider whose systems suffered a cyberattack. The breach caused the unauthorised video feed to air across several countries at the same time, leading the international provider to suspend its broadcasts.
Similar breaches occurred thousands of miles away in Southeast Asia. In Malaysia, the Kluang Municipal Council in Johor confirmed that hackers compromised several public municipal LED screens to show obscene footage. The local council disconnected all affected units immediately. Malaysian police initiated an inquiry after a local resident submitted video evidence circulating on private messaging networks.
In northeastern Brazil, an LED panel near the BR-343 highway in Campo Maior, Piauí, broadcast identical explicit material. Advertising firm Ferreira & Ferreira Publicidade e Comunicação confirmed the breach, shut down the hardware, apologised publicly, and lodged a complaint with local law enforcement.
Vulnerabilities in display transmission software
The perpetrators claimed they did not infiltrate individual roadside displays through local hardware tampering. Representatives of the Telegram channel Leakers$ told independent reporters that they exploited a flaw in central content management software responsible for distributing media to connected billboards.
A representative for the collective said participants scanned public internet addresses for roughly two hours to find exposed systems. They located thousands of display controllers that lacked authentication or basic network access controls. “It was a genuine vulnerability in the software responsible for transmitting content to LED displays,” the group said in an online interview.
The collective claimed that commercial networks spend substantial sums on physical LED infrastructure while leaving cloud control panels and transmission portals exposed to standard web crawlers. The group also published political criticism directed at the Egyptian government, though it stated it was not operating as a ransomware syndicate or demanding extortion payments.
Unconfirmed claims from the group indicated that display systems in Iraq and China were also accessed during the sweep, though independent verification of outages in those jurisdictions remains limited.
A history of public display breaches
Public advertising displays have long presented an attractive target for digital intruders due to inconsistent administrative hygiene. Internet-facing signage systems often run stripped-down operating systems that receive infrequent security patches from equipment operators.
In 2016, police in Jakarta, Indonesia, arrested a technician after an electronic billboard displayed adult videos to commuters following a credential leak. In 2022, a central commercial screen in Brisbane, Australia, was hijacked for several minutes before engineers cut power to the unit. Authorities in Baghdad, Iraq, ordered roadside screens switched off across the capital in August 2023 after an operator broadcast explicit footage during a contractual dispute.
Security assessments have repeatedly documented that system administrators fail to change factory credentials when deploying networked signs. The Out of Home Advertising Association of America published formal billboard security guidelines advising operators on structural controls, stating plainly: “Do not rely on default passwords from display manufacturers.”
What happens next
Municipal councils and private media agencies across the affected regions have left several digital installations offline while technical teams audit their software pipelines. Al Arabia United said it is coordinating with Egyptian security agencies to isolate the breached network endpoints.
Police departments in Kluang and Piauí are reviewing server access logs supplied by local display owners to trace the originating internet protocol addresses used during the automated scanning campaign.
