A large digital billboard above one of Egypt’s busiest highways was taken over by hackers who replaced its normal advertising with sexually explicit footage. Drivers on Cairo’s 26th of July Axis slowed down and stopped to film the screen, and clips of the hijacked display spread quickly across social media before the authorities stepped in.
The incident took place on 29 October on the major road linking Cairo with Giza and its western suburbs. The giant light-emitting display, normally used for commercial advertising, suddenly began showing unauthorised footage instead. That footage carried an overlay naming the people behind the takeover and giving the address of a messaging channel, a signature that soon became central to the investigation.
Egypt’s interior ministry confirmed that the billboard belonged to an advertising firm working under a contract with an international company. According to the ministry, the international company’s website had been subjected to a cyberattack, and that attack allowed the unauthorised footage to appear. The ministry added that screens in several other countries were affected at the same time, although it did not name the company or list every country. Legal proceedings, it said, had been started.
The operator of the Egyptian screen, Al Arabia United, said it had detected unauthorised access to one of its displays, shut that screen down as a precaution, and was working with the authorities. The company, a joint venture formed in 2022, operates a large network of billboards across Cairo, Giza, Alexandria and Egypt’s North Coast, including hundreds of digital units. Its statement mattered beyond a single screen, because it showed how one weak point in a shared system could reach a whole network.
A group calling itself Leakers$ claimed responsibility through a messaging channel. It said it had not broken into individual billboards one by one, or forced open a control box. Instead, it claimed, it exploited a weakness in the software used to send content to light-emitting displays, and found thousands of exposed systems through automated scanning in about two hours. Those claims have not been independently verified in full, and parts of the story resting only on the group’s account should be treated with caution.
Egypt was not the only place affected. Later reporting described similar unauthorised broadcasts on electronic billboards in Malaysia and Brazil, while the group also claimed to have reached screens in Iraq and China, where confirmation is thinner. In Malaysia, a municipal council in Johor confirmed that several public screens had been compromised and switched them off while it worked with its supplier to investigate. In Brazil, footage was reported from a street in Piaui state.
That pattern is what has alarmed security specialists. Modern digital billboards are not posters on a wall. They are computers connected to the internet, controlled remotely so an operator can change advertisements from an office and update a screen in seconds. That convenience is also the risk. If the content system is exposed to the public internet, protected by a weak or unchanged password, or left without proper access controls, an attacker who finds one flaw can potentially reach many screens at once.
This is not a new problem. In 2019, a billboard near a motorway interchange in Michigan in the United States showed explicit content for about twenty minutes before it was switched off. In August 2023, authorities in Baghdad disabled electronic advertising screens after explicit footage appeared in a public square. In 2022, a screen in Brisbane in Australia displayed similar material for several minutes, and in 2016 a man was arrested in Jakarta after broadcasting material on a public screen. The details differ, but the lesson repeats.
Industry guidance already exists for this risk. The Out of Home Advertising Association of America has told operators not to rely on manufacturers’ default passwords, not to reuse the same password across displays, to restrict access to management services, to use multi-factor authentication, and to protect remote connections with a virtual private network. Those are basic steps, and the fact that they need repeating after each incident suggests many operators have not yet treated them as essential.
For Egypt, the incident also raises a regulatory question. The country has a framework for roadside advertising under a law passed in 2020, which created a national authority for the regulation of roadside advertising. That framework governs where screens can be placed, but the breach shows that permission to put up a screen is only part of the job. Keeping control of what appears on it is now just as important, especially on a highway used by families and children.
What is clear is that the Cairo incident was disruptive and unwelcome, and its wider significance is larger than one screen. It showed how quickly a failure in shared software can cross borders, and how much work remains before the next screen is taken over.
