Leakers$ Hijacked Public LED Billboards in Egypt, Malaysia and Brazil

A billboard above the 26th of July Axis in Giza, on the highway that carries traffic between Cairo and the city's western suburbs, displayed sexually explicit video on Thursday 29 October 2026. Text laid over the footage read “Leaked by: Ch, 19ylegal never and nivex”, alongside a Telegram handle, @LeakersGov. CNN reported the incident the following day.

Related reading: Sony's Japanese ISP Arm Says a Breach Exposed 2.6 Million Records · A Firewall Campaign Exposed 70,000 Credentials. The VPN Sessions Are the Bigger Risk..

By then, similar hijacks had turned up in Malaysia and Brazil. Gizmodo and The Verge collected the reports on 1 November, and a group calling itself Leakers$ claimed responsibility for the campaign.

Three countries, three owners, three investigations. What the cases share is the kind of target: a public screen whose content arrives over a network, and an attacker who says it went after the systems behind the screen instead of the hardware itself.

Three countries, three operators

Egypt's screen belonged to Al Arabia United, according to the Interior Ministry. The company is an Egyptian-Saudi joint venture set up in 2022 by United Media Services, the media arm of Egypt's General Intelligence Service, and Saudi-listed Arabian Contracting Services. The Cairo Report, cited by Gizmodo, puts the estate at about 1,926 billboards, of which 239 are digital, spread across Cairo, Giza, Alexandria and the North Coast.

Ownership matters here because it decides who has to answer. United Media Services is the media arm of a security service, and Arabian Contracting Services is listed in Saudi Arabia, so this operator answers to a state body and to public shareholders at the same time. The Egyptian response came through formal channels: a ministry statement, a company statement and a legal case.

The ministry's account of the mechanism is short and specific. Al Arabia United had contracted an unnamed international company, and that company's website was attacked. As a result, the ministry said, the footage went out in several other countries at the same time. It said legal proceedings had begun and that the international company had suspended broadcasts. Al Arabia United said separately that it detected unauthorised access to one screen, shut it down as a precaution and was investigating with the authorities.

“in several other countries, simultaneously.”

Malaysia's case was municipal. The Kluang Municipal Council in Johor confirmed that several public LED screens had been hacked to show obscene content and said it had shut the affected screens down, The Star reported. Police opened an investigation after a 42-year-old man filed a report; he had received screenshots and videos of the screens through WhatsApp.

In Brazil, the panel stood on an avenue near the BR-343 in Campo Maior, Piauí. Ferreira & Ferreira Publicidade e Comunicação confirmed a cyberattack to G1, said it had shut the equipment down immediately, filed a police report and apologised.

The entry point, as the group describes it

Leakers$ gave its version of the method to The Cairo Report. The group said it exploited a vulnerability in the software used to transmit content to LED displays, not weaknesses in individual physical billboards. A representative said four participants, working under the pseudonyms Never, 19ylegal, CH and Nivex, found thousands of exposed systems through an automated random scan that lasted roughly two hours. Those systems were allegedly reachable through web pages and interfaces that lacked basic security protections.

Every part of that account comes from the group. No vendor advisory or CVE has been published for the flaw it describes, and no published forensic work ties the three national incidents to a single bug. Officials in Egypt, Malaysia and Brazil have confirmed that unauthorised access happened; they have not named a technical root cause.

The group also says it is not seeking donations or ransoms and is not a ransomware operation, casting its activity as the exposure of badly secured infrastructure. On the Friday after the hijacks it posted a political statement about Egypt. That framing invites scepticism, since publishing explicit material on a public road is a choice about who absorbs the cost of the message, and the people sitting in traffic on the 26th of July Axis did not get a say.

A website compromise can reach a street corner

The Egyptian ministry's account describes a chain with two links: a company website was attacked, and screens in several countries showed the result. The first link is ordinary web security. The second is the part that reaches the public. A panel that pulls its playlist from a remote management system inherits the security of that system, and nobody standing in front of the screen can tell whether the playlist was authorised.

Egypt says legal proceedings have started. It has not named the international company, published an incident report, or said how many screens outside Egypt were reached through the same channel. Those gaps leave the main question open: was the weak point one vendor's website, the way content was pushed from it, or both?

The timing suggests the three countries were not separate accidents. But simultaneity is also what a scheduled playlist looks like, and confirming a shared intrusion would require logs that no one has published.

The cross-border part matters for operators anywhere. The ministry said the footage reached several countries at once, which is what a shared content pipeline does when it works as designed. The same access that lets an advertiser schedule a campaign across a region lets whoever holds the account schedule something else. No border check sits between the content system and the panel.

A pattern older than this campaign

Public screens have been hijacked before. Jakarta's were hit in 2016, Brisbane's in 2022 and Baghdad's in August 2023, according to the incidents Gizmodo lists. Signage is operational technology that lives outdoors, it is frequently bought as a managed service, and the contract that covers it is usually about uptime and advertising reach, not incident response.

A website defacement can be reversed in an afternoon. A screen above a motorway cannot, and the audience cannot close a tab.

The industry's own guidance acknowledges the gap. The OAAA document is written for billboard operators, which is the right audience for a default-password warning. Egypt's account suggests the vendor's website belongs on the same checklist, because the screen is the last step in a chain that begins somewhere else entirely.

What the record supports, and what it does not

Three things are established. Sexually explicit material appeared on public screens in three countries on or around 29 October. Authorities or operators in each country confirmed unauthorised access. And Leakers$ claimed the operation, with a Telegram handle on the Egyptian screen that matches the group's public identity.

Almost everything else carries a qualifier. Attribution rests on the group's own posts plus official confirmation that someone got in. The software vulnerability is the group's description, not a finding. The claimed access in Iraq and China has thinner independent confirmation and should be read as a claim until local operators or authorities say otherwise.

The reporting so far concerns control of screens, not the theft of data. Nothing in the accounts from CNN, The Star or G1 describes customer records being taken, and the Egyptian ministry's statement is about broadcast access rather than exfiltration. That may change as investigations proceed, but there is no evidence of it now.

Egypt's version also carries the authority of a ministry rather than an independent forensic firm. It says a website was attacked. It does not say how, by whom, or whether the same access reached Malaysia and Brazil. The parallel timing is consistent with one shared intrusion, though only logs from the unnamed company would establish it.

What to watch

A vendor advisory or a CVE for the content-transmission software would move the group's central claim from assertion into the record, and it would give every operator something concrete to patch. Without one, the industry is left with a description of a flaw and no way to check whether its own systems have it.

Then there are the investigations. Malaysia's police case and Brazil's police report may produce technical details that Egypt's ministry has not. Egypt's legal proceedings may name the international company, which would let other customers of that vendor assess their own exposure. Watch for any of the three to publish a root cause rather than a statement of unauthorised access.

The claims about Iraq and China need a local confirmation or a denial before they belong in a count of affected countries.

And watch what operators change. Default credentials, exposed management interfaces and the separation between a public website and the system that pushes content to screens are all checkable items. Whether the sector treats this week as a warning or as an oddity will show up in procurement documents long before it shows up in another headline.

Contracts may move before the technical picture does. The unnamed company that lost control of its website is now a line in its customers' risk assessments, and those customers have a reason to ask what the vendor's access to their screens actually was. Other customers of that vendor need its name to check their own exposure, and Egypt has not released it.

Cover: “محور 26 يوليو.JPG” by لا روسا, CC BY-SA 4.0, via Wikimedia Commons (the 26th of July Axis in Egypt), cropped 16:9.