A hacking group claiming responsibility for displaying pornographic footage on a roadside billboard in Egypt told The Cairo Report that it exploited a software vulnerability affecting digital advertising screens in several countries, exposing what it described as widespread security failures in commercially operated infrastructure.
The group, which operates a Telegram channel called ‘Leakers$’, said its members discovered thousands of exposed systems through an automated scan lasting approximately two hours, during which it identified Iraq, Malaysia, Brazil, and China among the countries where it said it gained access to display systems.
The account follows an incident Thursday, Oct. 29, when sexually explicit footage appeared on a large electronic billboard overlooking one of the busiest highways in the country, the 26 July Corridor in Giza, which connects Cairo with its western suburbs.
Videos circulated on social media showed the footage playing on the screen, prompting authorities to suspend advertising displays along the road and open an investigation.
The affected billboard is operated by Arabian United, an Egyptian-Saudi advertising venture established by United Media Services (UMS), Egypt’s intelligence-linked media conglomerate, and Saudi-listed Arabian Contracting Services Co.
In a statement Thursday evening, Egypt’s Interior Ministry attributed the incident to the hacking of an unnamed international advertising company’s website, saying the same footage had appeared on screens in several countries simultaneously.
The ministry did not identify the international company, the countries affected, or any suspects. It also gave no technical explanation of how the alleged website breach translated into control over roadside advertising displays.
The group’s account broadly supports the ministry’s description of an international incident but provides a different level of technical detail.
In an exchange with The Cairo Report, a person speaking on behalf of the group said its members had exploited a vulnerability in the software used to transmit content to LED displays, rather than targeting the Egyptian billboard individually.
“It was a genuine vulnerability in the software responsible for transmitting content to LED displays,” the person said. “After exploiting it, we gained access to display systems in several countries, not just Egypt, but also Malaysia, Brazil, China, and others.”
The person added that the infrastructure was not exclusive to Egypt and contained multiple security flaws, including weaknesses accessible through the system’s own pages and interfaces.
Asked whether the operation involved exploiting an unknown software vulnerability or merely accessing poorly protected equipment exposed to the public internet, the representative described a software flaw but did not provide enough technical evidence to establish the precise method.
According to the representative, the group located its targets through automated scanning rather than selecting particular companies or countries.
“The systems were identified through an automated and random scan,” they said, adding that several participants using the online pseudonyms Never, 19ylegal, CH and Nivex were involved in identifying thousands of exposed systems over approximately two hours.
The representative shared visual records captured during the incident and referred to material on the group’s public Telegram channel.
The channel’s address was visible on the pornographic material displayed on the Egyptian billboard, allowing The Cairo Report to trace it and contact its administrators.
In its initial public statement, the group said its objective was to expose security failures rather than demand payment or carry out a ransomware attack.
“Companies charge millions to build infrastructure across multiple countries and leave LED screens and billboard networks wide open on the internet without basic protection,” the statement said.
The group also rejected the idea that taking control of the screens required advanced technical capabilities.
“It wasn’t nearly as complex an operation as many might imagine,” its representative told The Cairo Report.
Perhaps most importantly, the intrusion raises questions about cybersecurity oversight at Arabian United, whose shareholders include one of the Egyptian state’s most politically influential media companies.
UMS, the media arm of Egypt’s General Intelligence Service, was established in 2016 and controls more than 40 companies across television, newspapers, digital media, entertainment, and advertising.
The billboard’s operator, Arabian United, however, was established in 2022 through a partnership between UMS and Arabian Contracting Services Co., one of Saudi Arabia’s largest outdoor advertising businesses.
According to the Saudi company’s 2025 annual report, its Egyptian subsidiary operates a network of 1,926 advertising billboards, including 239 digital installations, across Cairo, Giza, Alexandria and the North Coast.
The Saudi company holds a 49.99% ownership stake in Arabian United but exercises effective corporate control through its 57% representation on the board of directors, according to its March 2026 financial statements.
The company’s annual report also says it supervises, manages, and operates every stage of the advertising process in Egypt, from installing screens and securing advertising clients to displaying their content.
That division of responsibilities is significant because the Interior Ministry attributed the incident to an “international service provider” without identifying it or explaining its contractual relationship with the Egyptian operator.
When asked what the incident suggested about the security capabilities of an advertising business associated with Egyptian intelligence, the group’s representative said such institutional connections offered no guarantee against technical weaknesses.
“If infrastructure operated by a company linked to Egyptian intelligence can be compromised, it demonstrates that such connections do not necessarily translate into strong cybersecurity,” the representative said.
Obviously, the association with UMS does not establish that Egyptian intelligence agencies were responsible for administering the compromised systems. It does, however, place the incident within a security apparatus-linked commercial network that has expanded its presence across some of Egypt’s most heavily monitored public spaces.
Arabian United acknowledged the intrusion, saying an unknown party had gained unauthorized access to one of its advertising screens.
The company said it had immediately suspended the screen, was investigating the incident in coordination with authorities, and that it “remained committed to the highest security and operating standards.”
Earlier in the day, security sources told Al-Shorouk that investigators were “examining whether the footage resulted from an external intrusion or had been uploaded by someone responsible for operating the screen.”
The incident also exposes a gap between the government’s extensive regulation of roadside advertising content and the publicly disclosed safeguards governing the digital systems on which that advertising increasingly depends.
Under Law No. 208 of 2020, Egypt established the National Authority for the Regulation of Roadside Advertising, reporting to the prime minister. Its board includes representatives of the defense, interior, and transport ministries, among other government bodies.
The authority is responsible for setting standards governing roadside advertising, including requirements concerning “public order and morality.”
At a September 2025 meeting, prime minister Mostafa Madbouly emphasized the need to “regulate advertising on public roads,” particularly “compliance with Egyptian societal values and the protection of the urban landscape.”
Neither that regulatory framework nor the government’s latest statements explain what cybersecurity standards apply to remotely operated advertising networks, whether the affected operator had undergone a security assessment, or who bears responsibility for auditing third-party software connected to publicly visible screens.
The Interior Ministry said legal procedures had been initiated but did not specify whether the investigation would examine failures by the Egyptian operator or its contractors.