On October 29, 2026, an electronic billboard along Egypt’s 26 July Corridor began displaying sexually explicit footage instead of advertisements. Videos circulated rapidly, and the incident initially appeared to be a case of a single compromised screen in Giza.
But the breach was not limited to Egypt.
The Ministry of Interior confirmed that an international advertising service provider had been hacked, causing unauthorized footage to appear on screens in several countries simultaneously. In Malaysia, authorities reported that eight public LED screens had been compromised on the same day.
The footage in Egypt also contained a clue: the Telegram address of a group calling itself Leakers$, alongside several online aliases. The group claimed responsibility for attacks on digital advertising systems and subsequently published statements criticizing cybersecurity failures and Egypt’s government.
The available evidence points to a wider international incident, although important questions remain about who carried it out, how the systems were accessed, and how many screens were affected.
What Happened on Egypt’s 26 July Corridor?
The affected screen, located along the 26 July Corridor toward Sheikh Zayed City, was operated by Alarabya United, an Egyptian-Saudi advertising company.
After the incident, the company acknowledged unauthorized access to one of its screens and suspended the display while investigating.
In an official statement, Egypt’s Ministry of Interior explained that the billboard operator had contracted an international company to distribute advertisements electronically.
According to the ministry, the international provider’s website had been hacked, resulting in unauthorized footage appearing on the Egyptian billboard and similar screens in multiple countries at the same time.
Legal procedures were initiated, and technical measures were taken to suspend the affected broadcasts.
The ministry did not identify the international provider, name the other countries, or disclose the method used to compromise the system.
These details matter because the Egyptian billboard may have been one visible endpoint of a breach affecting infrastructure used by multiple advertising operators.
Egypt Was Not the Only Country Affected
On October 29, public LED screens in Kluang, Malaysia, also began displaying obscene images and videos.
Malaysian police confirmed that eight screens belonging to the Kluang Municipal Council had been compromised. The council shut down the displays and contacted its technology supplier while authorities investigated.
Footage associated with the Malaysian incident reportedly contained a Leakers.Gov watermark, matching the group identifier linked to the Egyptian billboard.
This provides a potential connection between the two incidents, although it does not conclusively establish that the same individuals accessed both systems.
Leakers$ has claimed that advertising screens were compromised in five countries: Egypt, Malaysia, Iraq, Brazil, and China.
Reports of similar incidents have also emerged from Iraq and Brazil. However, the available evidence does not establish the technical relationship between every reported incident, and the claim involving China has not been independently confirmed through comparable public reporting.
The distinction is important. Egyptian authorities confirmed an international breach, Malaysian authorities confirmed eight compromised screens, and Leakers$ claimed responsibility for a broader operation. Those findings do not amount to independent confirmation of every country or system named by the group.
The Hackers Left Their Telegram Address on the Screen
The Egyptian footage displayed four online aliases: Ch, 19ylegal, never, and nivex. It also included t.me/LeakersGov, directing viewers to a publicly accessible Telegram channel associated with Leakers$.
Through the channel, the group claimed responsibility for compromising digital advertising systems and published statements discussing its activities and objectives.
In its manifesto, Leakers$ criticized companies for investing heavily in electronic advertising infrastructure while allegedly neglecting basic cybersecurity protections.
The group argued that expensive digital display networks had been left vulnerable to unauthorized access, allowing outsiders to interfere with the content shown on public screens.
It presented the operation as an attempt to expose security weaknesses rather than a financially motivated attack, distancing itself from ransomware operations, ransom demands, and requests for donations.
The group also challenged the idea that compromising these systems necessarily required sophisticated techniques, suggesting that inadequate security practices had made the attacks possible.
These statements explain how Leakers$ wants its actions to be understood. They do not independently establish the group’s motives or technical capabilities.
The choice to display sexually explicit footage remains unexplained. There is no verified information establishing why that video was selected or whether its content carried any particular significance.
However, including the group’s name and Telegram address on the billboard ensured that the incident also directed public attention toward Leakers$ itself.
The Group’s Political Statement About Egypt
On October 30, the LeakersGov Telegram channel published a statement criticizing Egypt’s political system.
It opened with the declaration:
“Egypt remains under a dictatorship.”
The message accused the government of maintaining power through repression and criticized the lack of progress and improvements in people’s lives.
The statement added an explicitly political dimension to the group’s public messaging.
Its cybersecurity manifesto and political criticism are both relevant to understanding how Leakers$ has presented the operation. However, neither establishes the original motivation behind the intrusion.
The group’s statements do not prove that Egypt was selected for political reasons, nor do they establish that exposing cybersecurity weaknesses was its only objective.
Who Are Leakers$?
Despite the group’s public claims, little independently verified information is available about the individuals behind it.
The aliases Ch, 19ylegal, never, and nivex appeared on the Egyptian billboard. Other reporting has associated names including Victor, Gbr, and Keven with the group.
Some alleged participants have claimed to be Brazilian, but their nationality, identities, and locations have not been independently established.
In an interview with The Cairo Report, someone claiming to represent Leakers$ described using automated scanning to identify thousands of exposed systems in approximately two hours.
The representative alleged that the group exploited weaknesses in software responsible for transmitting content to LED displays.
If accurate, that account could explain how advertising systems in different countries were accessed during the same period.
However, no publicly available forensic findings have confirmed the claimed scanning process, the number of vulnerable systems discovered, or the precise software weakness involved.
As of October 30, Egyptian authorities have not publicly identified suspects or officially attributed the intrusion to Leakers$.
How Could Billboards in Different Countries Be Compromised?
The international pattern is particularly significant because electronic billboards are often managed through connected software systems rather than controlled individually at their physical locations.
Advertising operators use digital content management platforms to upload, schedule, and distribute material remotely. Some manage these systems internally, while others depend on third-party technology providers.
Different advertising companies may also use the same software or services, creating potential connections between networks in otherwise unrelated countries.
This creates several possible routes for a cyberattack.
A vulnerability in widely used software could allow attackers to access multiple advertising networks separately. Alternatively, compromising a shared content distribution service could potentially affect screens operated by different companies.
Egypt’s Ministry of Interior attributed the incident to the website of an international advertising provider. Leakers$, meanwhile, claimed to have exploited weaknesses in LED transmission software.
These explanations are not necessarily incompatible, but the precise technical sequence remains unknown.
Without identifying the provider or examining the compromised systems, it is impossible to determine whether the incidents resulted from a single intrusion, a shared software vulnerability, or multiple related attacks.
This also explains why the involvement of Alarabya United, the Egyptian billboard operator, does not necessarily mean its own systems were the original point of compromise.
The company operated the affected screen, but the ministry’s findings indicate that a separate international provider was involved in distributing its advertising content.
That distinction raises questions about which company controlled the compromised technology and which party was responsible for securing it.
Authorities have not publicly disclosed the provider’s identity, the security weakness involved, or whether the intrusion resulted from compromised credentials, exposed administrative systems, or vulnerable software.
What the Attack Reveals About Digital Advertising Security
The immediate public reaction focused on the explicit footage, but the broader concern is the apparent ability of unauthorized parties to control content displayed on public advertising infrastructure.
If attackers can replace scheduled advertisements remotely, the potential consequences extend beyond offensive material.
Similar access could potentially be used to display fraudulent information, fabricated public announcements, or misleading messages in locations where viewers might assume the content was authorized.
There is no evidence that those activities occurred during the October 29 incidents. They nevertheless illustrate the potential consequences of inadequate protections for remotely managed public displays.
The international dimension also raises questions about accountability.
When advertising operators depend on external software and content distribution services, a vulnerability affecting one provider may have consequences for multiple companies and locations.
Determining responsibility requires understanding not only who owns the physical screen, but who manages the systems controlling its content.
Several important questions remain unanswered: the identities of the attackers, the international provider involved, the precise method of intrusion, the number of affected systems, and the motivation behind the operation.
Leakers$ has claimed responsibility and published statements criticizing cybersecurity failures and Egypt’s government. Egyptian and Malaysian authorities have confirmed compromised screens. But the relationship between those statements, the individual incidents, and the underlying technical breach has not been fully established.
What began as an explicit video on a billboard in Giza has exposed a larger concern about the security of interconnected advertising infrastructure.
The footage attracted the attention. How the attackers gained control of public screens across borders, and whether those vulnerabilities remain, is the question that matters now.
