Imagine driving home on a busy highway, glancing up at a giant digital billboard, and seeing something no advertiser ever paid for. That is exactly what happened to drivers in several countries in late October 2026, when billboards hacked by an unknown group suddenly switched from ordinary ads to pornographic videos. The clips spread across social media within hours, turning a cybersecurity failure into one of the most talked-about viral stories of the week.
The incident was shocking, but it was not random. The people claiming responsibility say they did not break into each screen one by one. Instead, they say they found a weakness in the software used to send content to the displays, and then used it again and again. What followed was a strange mix of public embarrassment, official investigations, and a serious warning about how many everyday screens are connected to the internet with far too little protection.
How the Billboards Hacked in Egypt Stopped Traffic
The most widely reported incident took place in Egypt. According to Gizmodo, a large electronic billboard over the 26th of July Axis in Giza showed pornographic footage on October 29, 2026. The road is one of the main routes linking Cairo to its western areas, so thousands of drivers were in a position to see it.
Motorists slowed down, pulled out their phones, and filmed the screen. Within hours, the videos were everywhere online. The footage reportedly showed the attackers’ aliases and a Telegram channel address overlaid on the video, according to TechSpot and reporting by Malwarebytes.
Egypt’s Interior Ministry, as cited by CNN and relayed by TechSpot, blamed a cyberattack on the website of an unnamed international company contracted by the billboard’s operator. The ministry said the breach caused footage to appear in several countries at the same time, and that legal proceedings had begun.
The Egyptian operator, Al Arabia United, said it shut down the affected screen after it detected unauthorized access and was working with the authorities to investigate. Gizmodo reports that the company runs about 1,926 billboards, 239 of them digital, across Cairo, Giza, Alexandria and the North Coast. That scale is part of why the story travelled so far: this was not a tiny screen on a quiet street, but a major display run by a major operator.
Malaysia and Brazil Confirmed Their Own Incidents
Egypt was the most visible case, but it was not the only one. In Malaysia, the Kluang Municipal Council confirmed that several public LED screens in Kluang, Johor, were hacked to show obscene content. Local officials acknowledged the breach publicly, which helped separate confirmed incidents from rumours spreading online.
Brazil also saw a confirmed incident. According to reporting relayed by Gigazine, local media reported that sexually explicit content appeared on an LED billboard on a main street in Campo Maior, in the state of Piauí. Gizmodo also reports a confirmed incident in Brazil.
Who Claims to Be Behind the Attack?
A group calling itself Leakers$, also referred to as LeakersGov, claimed responsibility for the attacks on Telegram. Its members use the aliases Never, 19ylegal, CH, and Nivex, according to reports based on the group’s own statements.
The group told The Cairo Report, an independent Egyptian media outlet, that it did not target individual physical billboards. Instead, it said it exploited a flaw in the software used to transmit content to LED displays. The group said a roughly two-hour automated random scan identified thousands of vulnerable systems that were accessible through web pages and interfaces lacking basic security measures.
The group also boasted that the hack was so simple that “anyone with two brain cells” could have done it, according to Gizmodo. That is the group’s boast, not a verified assessment, but it was repeated widely because it captured the most worrying part of the story: the attackers claim they did not need rare skills or expensive tools.
How Did the Hackers Get In?
Based on the group’s own account, the attack worked like this. First, the attackers scanned the internet for systems connected to billboard display software. Then, they found systems that were reachable through ordinary web pages and interfaces without proper protection. Finally, they used a flaw in that software to push their own content to the screens.
None of that has been independently confirmed by the operators or the authorities, so it should be read as the group’s version of events. Even so, cybersecurity experts quoted in coverage of the incident say the basic idea is plausible, because similar weaknesses have caused similar problems before.
One common problem is default passwords. Many internet-connected devices are shipped with a factory username and password, and operators are supposed to change them during setup. When that step is skipped, anyone who knows or guesses the default login can get in. Cyber experts note that many billboard hacking incidents occur because operators forget to change default passwords from the manufacturer on their web interfaces, according to reporting relayed by Indonesianow.
Another problem is exposure. A billboard content system does not need to be reachable from the public internet to do its job. In many setups, it only needs to be reachable from the operator’s own network. When the management interface is left open to the whole internet, it becomes searchable, and searchable systems get probed constantly by automated scans.
Why Billboards Hacked Around the World Is a Bigger Warning
It is easy to treat this story as a prank that went viral, but the underlying issue is much bigger than one embarrassing week for a few operators. Digital billboards are part of a much larger family of internet-connected displays. The same kind of software and the same kind of weak setup can be found in shopping centres, transport hubs, hotels, restaurants, schools, hospitals and office lobbies.
When a screen is hacked, the immediate harm is public exposure to explicit content, including by children who happen to be nearby. That alone is serious. But the same access could be used for other purposes. A compromised screen could show false emergency messages, political propaganda, scams, or misleading instructions during a real crisis. The content in this case was pornographic, but the weakness itself is content-neutral. Whoever controls the screen controls the message.
This Has Happened Before
As Gizmodo noted, this is not the first time digital billboards have been hacked to play pornography. In 2022, a screen in Brisbane, Australia, showed pornography for several minutes before it was shut off.
TechSpot also reported other earlier cases, including an Asics store in New Zealand whose outdoor screens showed porn for nine hours, as well as similar previous hacks in Australia, Indonesia and Iraq. The details differ from case to case, but the pattern is familiar: a public display, a weak connection to the internet, and a long gap before anyone notices or can switch it off.
The difference in 2026 was scale. Instead of one screen in one city, the claim was that systems in several countries were reached through the same software weakness. Even if only the three confirmed countries are counted, that is still a coordinated, multi-country incident rather than an isolated prank.
What Operators and Authorities Did Next
The immediate response was practical: shut the screens down. Al Arabia United said it shut down the affected screen in Egypt after detecting unauthorized access. In Malaysia, the local council confirmed the compromise of its public screens, which is the first step toward fixing them and reassuring the public.
Behind the scenes, the real work is less visible. Operators need to find every system that uses the same software, check whether it is exposed to the internet, change any default credentials, add proper authentication, and log who accesses the system and when. Those are basic steps, but they are the steps that prevent the next incident.
For readers, there is also a useful lesson about viral videos. The clips filmed by drivers were genuine evidence that something had happened, but they were not proof of every claim attached to them. The group’s statements about how many countries it reached, how easy the hack was, and why it did it are all self-reported. The confirmed facts are the locations, the operator statements, and the official confirmations. Everything else deserves a second look.
If you enjoy following how online culture and technology collide, this story sits right at that intersection. It is also a reminder that the most viral tech stories are often not about new technology at all. They are about old technology, set up badly, in a place where everyone can see the result. For more on how viral moments travel online, see our roundup of TikTok trends in the first week of November 2026, and for another case where a platform’s hidden behaviour became the story, read our report on the OpenAI hidden microphone scandal.
What It Means for Public Screens Going Forward
The most likely outcome is a quiet wave of security checks across the outdoor advertising industry. Operators who use the same kind of content software will want to know whether their systems are exposed. Cities that own public LED screens will want to know who can log in to them and how that access is tracked. Advertisers will want reassurance that their ads will not be replaced by something they never approved.
- Change every default password and use strong, unique credentials for each system.
- Keep billboard management interfaces off the public internet wherever possible, and use a private network or VPN instead.
- Turn on multi-factor authentication for anyone who can publish content to a screen.
- Keep the display software updated and patch known flaws quickly.
- Log every login and content change, and set up alerts for unusual activity.
- Have a fast shutdown plan so a compromised screen can be switched off in minutes, not hours.
None of these steps is exotic. That is the point. The fixes are ordinary, well-known practices. The problem is that they are easy to skip when a screen is installed quickly, managed by a third party, or treated as advertising equipment rather than as a computer connected to the internet.
Key Takeaways
- Digital billboards in Egypt, Malaysia and Brazil were confirmed hacked to show pornographic content in late October 2026.
- The most prominent case was a large screen over the 26th of July Axis in Giza, Egypt, on October 29, 2026.
- The group Leakers$ claims it exploited a flaw in the software used to send content to LED displays, not the screens themselves.
- Claims involving Iraq and China have not been independently confirmed.
- Similar incidents have happened before, including in Brisbane in 2022 and at a store in New Zealand.
- Default passwords and internet-exposed management interfaces are among the most common weaknesses behind these attacks.
The billboard hacks of October 2026 were shocking because they were public, visual and impossible to ignore. Drivers did not need to understand cybersecurity to understand what had gone wrong. A screen that should have shown an ad showed something else entirely, and everyone on the road could see it.
That visibility is also why the story matters beyond the shock value. It showed, in the most public way possible, that many of the screens around us are computers first and billboards second. When they are secured like computers, they are much harder to hijack. When they are not, anyone who finds the weakness can take over the message. The operators, cities and advertisers who run these screens now have a clear choice: fix the basics now, or wait for the next viral video to make the same point again.