Region: Global (Egypt / Malaysia / Brazil; attacks also claimed in Iraq and China) | Date: November 2, 2026
Digital out-of-home advertising suffered one of its most visible security incidents in recent memory over the weekend, when LED billboards in multiple countries were hijacked and forced to display unauthorized content. Reports published on November 2 describe a coordinated operation that appears to have struck screens in Egypt, Malaysia and Brazil almost simultaneously, with the group behind the attacks also claiming to have compromised displays in Iraq and China, a claim that has not yet been independently verified.
In Egypt, the most prominent target was a large electronic screen on the 26th of July Axis in Giza, a major artery connecting Cairo with its western suburbs. According to local reports carried by Indonesian outlets citing Detik iNET, the screen suddenly began airing content that had nothing to do with its scheduled advertising, alongside text that named the group allegedly responsible and pointed to a Telegram channel. The screen is managed by Al Arabia United, a joint venture operating in the Egyptian and Saudi media intelligence space. The operator says it detected the unauthorized access and took the screen offline while cooperating with the authorities.
In Malaysia, the Kluang Municipal Council in Johor confirmed that several of its public LED screens had been breached. The council switched off the affected displays and handed the case to the police, who have opened an investigation. In Brazil, a screen on a main road near BR-343 in Campo Maior, Piauí, was also hit. The operating company, Ferreira & Ferreira Publicidade e Comunicação, shut down the equipment and reported the incident to local police.
The group claiming responsibility operates through a Telegram channel that has been circulating under the handle @LeakersGov, with individual members identified by pseudonyms including Never, 19ylegal, CH and Nivex. In statements provided to The Cairo Report, the group said the operation exploited weaknesses in the software used to deliver content to LED screens, rather than requiring physical access to each device. They claimed that a roughly two-hour automated scan uncovered thousands of vulnerable systems, many of them reachable through web interfaces that lacked even basic protection. They also pointed to default passwords left unchanged by operators as a major contributing factor.
Notably, the group says it is not seeking ransom or donations. Its stated goal, according to the same statements, is to demonstrate how exposed internet-connected public advertising infrastructure has become. “Companies spend millions building infrastructure in different countries, but leave LED screens and advertising networks connected to the internet without adequate basic protection,” one representative was quoted as saying.
The incident raises urgent questions for the digital out-of-home industry. As LED networks scale and more screens become programmatically connected, the content delivery chain from ad server to screen is emerging as a critical attack surface. Operators are now being forced to treat cybersecurity not as an IT afterthought but as a core operational requirement, covering network segmentation, credential management, firmware updates and remote-access controls. Municipalities and advertising landlords, who hold public-space concessions, are equally exposed when their contracted operators fail to secure their systems.
For brands and agencies, the episode is a reminder that a hijacked screen is not just an operational failure but a brand-safety and public-trust risk. Regulators in several markets are expected to revisit certification requirements for outdoor digital media following the incident, and industry bodies may push for baseline security standards similar to those seen in other connected-device categories.
Why it matters: The attack marks a turning point for DOOH security awareness: a single vulnerability class was used to reach screens across multiple countries at once, showing that public advertising infrastructure has become an attractive and under-protected target for politically motivated and reputational attacks.
Source: MediaKompeten (via Detik iNET)
