# Digital signage security incidents

> A dated, sourced record of hijacked screens, ransomware, exploited vulnerabilities and other security incidents involving digital signage and public displays.

Source: https://signagelist.org/incidents/

## 2026-11-06: Georgia elementary school digital sign hacked to show pornographic image

Georgia, USA · Screen hijack

A Georgia elementary school's digital sign was hacked and displayed a pornographic image. School officials shut the sign down once the image was reported. Digital Signage Today published the report on November 6, 2026, and no suspect was named in the coverage.

Sources: [Digital Signage Today](https://www.digitalsignagetoday.com/news/georgia-school-digital-sign-flashes-porn-image/)

## 2026-10-29: Kluang council LED screens in Johor show obscene content

Kluang, Johor, Malaysia · Screen hijack

Several LED screens run by the Kluang Municipal Council in Johor showed obscene content on the evening of October 29, 2026, the same night as the Giza incident. The council shut down all screens under its jurisdiction, and police opened a probe under Section 4(1) of the Computer Crimes Act 1997 and Section 292 of the Penal Code.

Sources: [Malay Mail](https://www.malaymail.com/amp/news/malaysia/2026/10/31/police-probe-hacking-of-kluang-council-led-screens-after-obscene-content-displayed/241350), [Marketing Interactive](https://www.marketing-interactive.com/digital-OOH-displays-hacked-Malaysia-obscene-content), [KRDO](https://krdo.com/news/2026/10/30/egyptian-highway-billboard-hacked-to-show-porn/), [NewsBytes](https://www.newsbytesapp.com/news/science/hackers-hijack-led-billboards-in-multiple-countries-to-display-porn/story), [Mediaweek](https://www.mediaweek.com.au/technology/hackers-broadcast-porn-on-major-billboard-in-coordinated-cyberattack)

## 2026-10-29: Pornographic video on Giza highway LED billboard

Giza, Egypt · Screen hijack

A pornographic video appeared on a large digital billboard along the 26 July Corridor in Giza on October 29, 2026. Egypt's interior ministry said the screen belonged to an advertising firm under contract with an international company. The operator, Al Arabia United, said it shut the screen.

Sources: [KRDO](https://krdo.com/news/2026/10/30/egyptian-highway-billboard-hacked-to-show-porn/), [International Business Times UK](https://www.ibtimes.co.uk/egypt-billboard-hacked-international-cyberattack-1829817), [NewsBytes](https://www.newsbytesapp.com/news/science/hackers-hijack-led-billboards-in-multiple-countries-to-display-porn/story), [Mediaweek](https://www.mediaweek.com.au/technology/hackers-broadcast-porn-on-major-billboard-in-coordinated-cyberattack)

## 2026-10-28: Xibo CMS digital signage platform has five flaws, including privilege escalation

Global · Vulnerability

NVD published 5 vulnerabilities in Xibo CMS, covering privilege escalation and authorization bypass. Xibo is an open source digital signage platform with a web content management system and Windows display player software.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-50541), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-52729), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-50539), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-50542), [source](https://github.com/xibosignage/xibo-cms/commit/98b347d3bf81d369ebe67bde030b913085a11556), [source](https://github.com/xibosignage/xibo-cms/commit/bba1bd82da8fb96919ba07462fe06ddacb22116b)

## 2026-10: LED panel in Campo Maior, Brazil shows pornographic content

Campo Maior, Piaui, Brazil · Screen hijack

An LED panel on an avenue near the BR-343 in Campo Maior, Piaui, showed pornographic content in late October or early November 2026. Reports also named Iraq and China as places where similar content appeared, but the Brazil case rests only on the press reports cited here.

Sources: [Malwarebytes](https://www.malwarebytes.com/pt/blog/bugs/2026/11/hackers-put-porn-on-public-billboards-and-claim-it-was-far-too-easy), [NewsBytes](https://www.newsbytesapp.com/news/science/hackers-hijack-led-billboards-in-multiple-countries-to-display-porn/story)

## 2026-09-02: Drupal Digital Signage Framework lacks authorization checks, allowing forceful browsing

Global · Vulnerability

NVD published a missing authorization flaw in the Drupal Digital Signage Framework. It allows forceful browsing.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-81166), [source](https://www.drupal.org/sa-contrib-2026-109)

## 2026-09: I-405 Caltrans message board in Los Angeles hijacked to show a website address

Los Angeles, California, USA · Screen hijack

A temporary Caltrans sign near Westwood on the I-405 flashed the address of a website that exposes Iranian dissidents, first seen on September 8, 2026. Caltrans said the unit was used for the Sepulveda Pass pavement project. The LA Times reported that the site showed photos of Iranian protesters in the US and Canada, and no arrests were reported.

Sources: [Cybernews](https://cybernews.com/news/la-freeway-sign-hijacked-to-doxx-political-dissidents-in-latest-iranian-linked-hacking/), [DNYUZ (republishing the Los Angeles Times)](https://www.dnyuz.com/?p=279301)

## 2026-09: Mobile traffic sign on Don Mills Road in Toronto hacked to show political messages

Toronto, Ontario, Canada · Screen hijack

A mobile digital traffic sign on Don Mills Road in North York, Toronto, was hacked to flash profane and anti-US government messages, including one against police use of Flock license plate cameras. The sign was removed once discovered, and authorities had no information on who was responsible.

Sources: [Digital Signage Today](https://www.digitalsignagetoday.com/news/mobile-digital-sign-hacked-in-toronto/), [Toronto Sun via MSN](https://www.msn.com/en-ca/news/other/digital-traffic-sign-in-toronto-hacked-to-display-profane-messages/ar-AA2c5TPT)

## 2026-08-31: Xibo CMS digital signage platform has a privilege escalation flaw

Global · Vulnerability

NVD published a privilege escalation flaw in Xibo CMS. Xibo is an open source digital signage platform with a web content management system and Windows display player software.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-52730), [source](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-6h64-j36j-h2v2)

## 2026-08-19: Italian display firm Euroscreen listed on TheGentlemen ransomware leak site

Italy · Breach

The TheGentlemen ransomware group listed Euroscreen, an Italian display and visualization technology company, on its leak site on August 19, 2026. SOCRadar noted that leak-site listings cannot always be independently verified, and the source found no company confirmation.

Sources: [SOCRadar](https://socradar.io/blog/data-breach/euroscreen-thegentlemen-2026/)

## 2026-08-12: Bass Highway traffic sign in Tasmania hijacked overnight to show a vulgar message

Bass Highway between Rocky Cape and Detention River, Tasmania · Screen hijack

An electronic traffic sign on the Bass Highway in Tasmania's north-west was tampered with overnight on 11 to 12 August 2026 and showed an offensive insult aimed at passing motorists. Building Tasmania said it was a contractor's sign, reset to its intended message at 7.30am, and that the contractor would report any damage to police.

Sources: [Pulse Tasmania](https://pulsetasmania.com.au/news/bass-highway-traffic-sign-hijacked-to-display-vulgar-message/)

## 2026-07: Melawi regency videotron in West Kalimantan shows obscene video

Melawi, West Kalimantan, Indonesia · Screen hijack

An obscene video played on a public videotron on the Tugu Naruto route in Nanga Pinoh, Melawi, on 27 July 2026 and spread widely on social media. Melawi's Diskominfo said the management credentials for the screens were changed, and the regency government apologized. A joint investigation was still underway with no suspect reported at the time of the coverage.

Sources: [Jawa Pos](https://www.jawapos.com/berita-daerah/2607280198/viral-videotron-di-melawi-kalbar-tayangkan-video-tak-senonoh-pemkab-minta-maaf), [Merdeka.com](https://www.merdeka.com/peristiwa/read/8255969/heboh-adegan-tak-pantas-di-videotron-kabupaten-melawi-pemkab-buka-suara), [RMOL](https://rmol.id/publika/read/2026/07/29/716335/video-tak-senonoh-muncul-di-videotron-di-melawi), [detikcom](https://www.detik.com/sumut/berita/d-8593896/viral-videotron-tampilkan-video-porno-pemkab-melawi-sebut-diretas), [GoNews.co](https://www.gonews.co/berita/baca/2026/07/28/diretas-videotron-di-jalur-utama-melawi-tayangkan-video-asusila)

## 2026-07: Portland, Maine road sign reprogrammed to show a political message

Portland, Maine, USA · Screen hijack

An electronic road sign on Brighton Avenue, owned by a local sand and gravel company, was reprogrammed to display a political message, according to a WGME photo reposted by Boing Boing. The report said a password left at default or unlocked controls could explain the change, and no police or company statement was found.

Sources: [Boing Boing](https://boingboing.net/2026/07/28/road-sign-reprogrammed-to-protest-ice-killings.html), [MSN (WGME)](https://www.msn.com/en-us/news/other/road-sign-in-portland-hacked-to-protest-ice-killings/ar-AA28NzLS)

## 2026-06-25: Daktronics LED sign controllers have three flaws, including default admin credentials

Global · Vulnerability

CISA's advisory ICSA-26-176-04 covers three flaws in Daktronics VFC-DMP-5000, DMP-5000 and DMP-8000 controllers that drive large LED displays, including highway signs and billboards. They are an unauthenticated path traversal (CVE-2026-28701), an authenticated arbitrary file upload (CVE-2026-33560) and default administrator credentials (CVE-2026-31928). Researcher Thomas Jou reported them through CISA's VINCE in January 2026, and Daktronics shipped patched firmware in March 2026, but the researcher said field testing found most internet-exposed units still used the default admin credentials.

Sources: [CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04), [SecurityWeek](https://www.securityweek.com/new-controller-flaws-expose-highway-signs-and-billboards-to-remote-hacking/), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-28701), [SecurityWeek](https://www.securityweek.com/new-controller-flaws-expose-highway-signs-and-billboards-to-remote-hacking/amp/), [cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2026-33560)

## 2026-06-11: Garlic-Hub, a self-hosted digital signage manager, has a security flaw

Global · Vulnerability

NVD published a security flaw in Garlic-Hub, a self-hosted tool that manages digital signage networks, devices, content and playlists from a single interface.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-47170), [source](https://github.com/garlic-signage/garlic-hub/commit/076b6d70a43d9641c35cbd8042353b473e3241f5), [source](https://github.com/garlic-signage/garlic-hub/security/advisories/GHSA-x24v-76hr-989r)

## 2026-06-10: Xibo CMS digital signage platform has a cross-site scripting flaw

Global · Vulnerability

NVD published a cross-site scripting flaw in Xibo CMS. Xibo is an open source digital signage platform with a web content management system and Windows display player software.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-42558), [source](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-6389-j56c-9fww)

## 2026-05-16: iDS6 DSSPro digital signage system has a CAPTCHA bypass that defeats authentication

Global · Vulnerability

NVD published an authentication bypass flaw in iDS6 DSSPro Digital Signage System. In version 6.2, a CAPTCHA security bypass lets attackers get past authentication by requesting the autoLoginVerifyCode object.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-37228), [source](http://www.yerootech.com), [source](https://www.exploit-db.com/exploits/48991)

## 2026-05-12: Xibo CMS digital signage platform has a server-side request forgery flaw

Global · Vulnerability

NVD published a server-side request forgery flaw in Xibo CMS. Xibo is an open source digital signage platform with a web content management system and Windows display player software.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-42141), [source](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-fwq8-c4gw-pxmh)

## 2026-05: LA Metro arrival screens go dark during a breach of the transit agency's systems

Los Angeles, California, USA · Breach

Some arrival screens at Los Angeles County Metro stops were disabled during a breach of the transit agency's systems, and riders could not load transit cards; trains and buses kept running. The attackers reportedly took at least 700 GB of emails, backups and files.

Sources: [Reuters (via Internazionale)](https://www.internazionale.it/ultime-notizie-reuters/2026/05/26/iranian-hackers-responsible-for-los-angeles-transit-system-breach-israeli-researchers-say)

## 2026-04-24: Samsung MagicINFO 9 Server path traversal flaw CVE-2024-7399 added to CISA's KEV catalog

Global · Vulnerability

CISA added CVE-2024-7399, a path traversal flaw in Samsung MagicINFO 9 Server, to its Known Exploited Vulnerabilities catalog on April 24, 2026, based on evidence of active exploitation. The flaw lets unauthenticated attackers upload JSP files and run code with system-level access. Samsung fixed it in version 21.1050 in August 2024.

Sources: [Security Affairs](https://securityaffairs.com/191281/security/u-s-cisa-adds-simplehelp-samsung-and-d-link-flaws-to-its-known-exploited-vulnerabilities-catalog), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-7399)

## 2026-04-10: Samsung MagicINFO 9 Server default permissions flaw allows local privilege escalation

Global · Vulnerability

NVD published a local privilege escalation flaw in Samsung MagicINFO Server. It comes from incorrect default permissions in MagicINFO 9 Server, which is affected below version 21.1091.1.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-25203), [source](https://security.samsungtv.com/securityUpdates)

## 2026-04: Tamil Nadu state bus route board shows a political party name instead of its route

Tamil Nadu, India · Screen hijack

The electronic route board on a Tamil Nadu State Transport Corporation bus showed a political party's name instead of route details, confusing passengers. The corporation said an inquiry found unidentified people had allegedly tampered with the display software and uploaded the content. It replaced the display unit's motherboard to restore route information and told the service provider running the signboards to prevent a repeat.

Sources: [Afternoon News](https://afternoonnews.in/article/tvk-party-name-flashes-on-govt-bus-display-triggers-stir/)

## 2026-04: Xibo CMS April 2026 advisories include SQL injection, stored XSS, SSRF and IDOR flaws

Global · Vulnerability

A batch of Xibo CMS advisories published in April 2026 includes CVE-2026-31952, a SQL injection through the API DataSet filter parameter rated 7.6, and CVE-2026-31953, a stored XSS in the notification body. The batch also lists an authenticated server-side request forgery in remote DataSet functionality (CVE-2026-31955) and an IDOR in Preview and SavedReport (CVE-2026-31956). The fixed versions for these entries were not confirmed.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-31952), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-31953), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-31955), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-31956), [source](https://github.com/dasgarner/xibo-cms/commit/b8d25fe6cb0232b645c3850afdc2499b0e46c1e6), [source](https://github.com/xibosignage/xibo-cms/commit/87e0a26b0c06e349561a6becdc00f3bb01259736)

## 2026-03-12: Israel Railways information screens show fake Iranian missile warnings

Several Israel Railways stations, Israel · Screen hijack

Advertising and information screens at several Israel Railways stations showed warnings of an incoming Iranian missile attack and told travelers to evacuate to shelters. One message read, "The subway is not safe at the moment." The screens were shut down temporarily, and no group was blamed while an investigation was opened.

Sources: [Jewish News Syndicate](https://www.jns.org/the-subway-is-not-safe-cyberattack-targets-israel-railway-stations/)

## 2026-03: Digital LED sign on fire truck outside Mama Lena Firehouse Grill shows offensive messages

Kennedy Township, Pennsylvania, USA · Screen hijack

A digital LED sign on a fire truck parked outside Mama Lena Firehouse Grill on Fairhaven Road showed offensive messages in the week of March 19, 2026. The restaurant said the sign was hacked and taken down, and Kennedy Township police are investigating.

Sources: [TribLive](https://triblive.com/local/kennedy-township-restaurant-says-sign-was-hacked-with-racist-message)

## 2026-02-12: BrightSign players shipped guessable default password (CVE-2025-54756)

Global · Vulnerability

BrightSign OS series 4 before 8.5.53.1 and series 5 before 9.0.166 had a default password that can be guessed from device information. The CVE was published to NVD on February 12, 2026. The fixed firmware only covers new installations, so existing players need their passwords changed by hand.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-54756), [VulDB](https://vuldb.com/vuln/345784), [source](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-126-03.json), [source](https://www.brightsign.biz/resources/software-downloads/)

## 2026-02-02: Samsung MagicINFO Server has three flaws, including stored XSS through HTML uploads

Global · Vulnerability

NVD published 3 vulnerabilities in Samsung MagicINFO Server, covering cross-site scripting, privilege escalation and hard-coded credentials. A flaw in MagicINFO 9 Server lets authorized users upload HTML files without authentication, leading to stored XSS that can result in account takeover. This issue affects MagicINFO 9 Server: less than 21.1090.1.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-25200), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-25201), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-25202), [source](https://security.samsungtv.com/securityUpdates)

## 2026-02: Karachi DHA digital ad screens show an obscene video, police arrest an employee

Karachi, Pakistan · Insider

An obscene video played on digital advertising screens along Khayaban-e-Ittehad in Karachi's DHA area, prompting protests and a temporary shutdown of screens on several roads. Police arrested a company employee who said he had mistakenly played a video stored on his phone, while the company suspected someone had accessed the system without authorisation. A case was registered under Section 292 of the Pakistan Penal Code.

Sources: [Daily Pakistan](https://en.dailypakistan.com.pk/05-Feb-2026/inappropriate-content-displayed-on-digital-billboards-in-karachi-after-hacking-attack), [The Express Tribune](https://tribune.com.pk/story/2590970/police-arrest-suspect-after-obscene-video-played-on-digital-screens-in-karachis-dha)

## 2026-01-06: Adtec SignEdje player has hardcoded default credentials that allow remote access

Global · Vulnerability

NVD published a default credentials flaw in Adtec SignEdje player. In Adtec Digital SignEdje Digital Signage Player v2.08.28, multiple hardcoded default credentials allow unauthenticated remote access to web, telnet and SSH interfaces.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36915), [source](https://exchange.xforce.ibmcloud.com/vulnerabilities/190628), [source](https://packetstorm.news/files/id/159709)

## 2026-01-06: Cayin Signage Media Player has an authenticated command injection flaw in two CGI pages

Global · Vulnerability

NVD published a command injection flaw in Cayin Signage Media Player 3.0. The flaw is authenticated and remote, and it sits in the system.cgi and wizard_system.cgi pages.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36910), [source](https://cxsecurity.com/issue/WLB-2020060049), [source](https://exchange.xforce.ibmcloud.com/vulnerabilities/182924)

## 2026-01-06: iDS6 DSSPro digital signage system has three flaws, including cleartext credentials

Global · Vulnerability

NVD published 3 vulnerabilities in iDS6 DSSPro Digital Signage System, covering cleartext credentials, CSRF and privilege escalation. In version 6.2, a sensitive information disclosure flaw lets remote attackers intercept authentication credentials through cleartext cookies.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36917), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36918), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36920), [source](https://cxsecurity.com/issue/WLB-2020110023), [source](https://exchange.xforce.ibmcloud.com/vulnerabilities/191261)

## 2026-01-06: Plexus anblick digital signage management has an open redirect flaw in its login script

Global · Vulnerability

NVD published an open redirect flaw in Plexus anblick Digital Signage Management. In version 3.1.13, attackers can manipulate the 'pagina' GET parameter in the 'PantallaLogin' script.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36912), [source](https://exchange.xforce.ibmcloud.com/vulnerabilities/185521), [source](https://packetstormsecurity.com/files/158473)

## 2026-01-06: QiHang Media Web Digital Signage 3.0.9 sends login credentials in cleartext cookies

Global · Vulnerability

NVD published a cleartext credentials flaw in QiHang Media Web Digital Signage. In version 3.0.9, remote attackers can intercept user authentication credentials sent as cleartext cookies.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36914), [source](https://cxsecurity.com/issue/WLB-2020080059), [source](https://exchange.xforce.ibmcloud.com/vulnerabilities/186770)

## 2026-01-06: RED-V Super Digital Signage System lets unauthenticated users read webserver logs

Global · Vulnerability

NVD published an information disclosure flaw in RED-V Super Digital Signage System. In version 5.1.1, unauthenticated attackers can access sensitive webserver log files.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36921), [source](https://cxsecurity.com/issue/WLB-2020110130), [source](https://exchange.xforce.ibmcloud.com/vulnerabilities/191803)

## 2026-01-06: Sony BRAVIA Digital Signage has three flaws, including API information disclosure

Global · Vulnerability

NVD published 3 vulnerabilities in Sony BRAVIA Digital Signage, covering information disclosure, insecure object references and cross-site scripting. In version 1.7.8, an information disclosure flaw lets unauthenticated attackers access sensitive system details through API endpoints.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36922), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36923), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36924), [source](https://cxsecurity.com/issue/WLB-2020120028), [source](https://exchange.xforce.ibmcloud.com/vulnerabilities/192606)

## 2026-01-06: TDM Digital Signage PC Player flaw lets authenticated users modify executable files

Global · Vulnerability

NVD published a privilege escalation flaw in TDM Digital Signage PC Player 4.1.0.4. It lets authenticated users modify executable files.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36916), [source](https://exchange.xforce.ibmcloud.com/vulnerabilities/190627), [source](https://packetstorm.news/files/id/159723)

## 2026: Watchfire sign controllers ship hard-coded plaintext TLS keys (CVE-2026-5846)

Global · Vulnerability

Watchfire controller software for BC550, BC750, BC760 and BC760DC sign controllers ships self-signed RSA private keys for the HTTPS web management interface. The keys sit in plaintext inside the firmware patch binaries, so anyone who downloads a patch can recover them. Scores conflict (7.6 under CVSS 4.0 and 5.7 under CVSS 3), and the sources checked report no confirmed exploitation.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-5846)

## 2025-12-17: Road signs in Denver hijacked by activists to protest dangers of driving

Denver, Colorado, USA · Screen hijack

Activists in Denver hijacked road signs to protest the dangers of automobility. Streetsblog USA reported the action in December 2025.

Sources: [Streetsblog USA](https://usa.streetsblog.org/2025/12/17/denver-activists-hijack-road-signs-to-decry-the-dangers-of-automobility)

## 2025-12-10: All-Dynamics Digital Signage System CSRF flaw lets attackers create administrative users

Global · Vulnerability

NVD published a cross-site request forgery flaw in All-Dynamics Digital Signage System 2.0.2. It lets attackers create administrative users without proper request validation.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36900), [source](https://www.all-dynamics.de), [source](https://www.exploit-db.com/exploits/48736)

## 2025-12-10: BrightSign diagnostic web server has an unauthenticated server-side request forgery flaw

Global · Vulnerability

NVD published a server-side request forgery flaw in BrightSign players. In the BrightSign Digital Signage Diagnostic Web Server 8.2.26 and earlier, the Download Speed Test service can be abused without logging in through the 'url' GET parameter.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36884), [source](https://github.com/zeroscience), [source](https://www.brightsign.biz)

## 2025-12-10: EIBIZ i-Media Server has four flaws, including unauthenticated privilege escalation

Global · Vulnerability

NVD published 4 vulnerabilities in EIBIZ i-Media Server, covering privilege escalation, path traversal, authentication bypass and insecure object references. In Eibiz i-Media Server Digital Signage 3.8.0, an unauthenticated privilege escalation flaw in the updateUser object lets attackers modify user roles.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36892), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36893), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36894), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36895), [source](http://www.eibiz.co.th), [source](https://www.exploit-db.com/exploits/48774)

## 2025-12-10: QiHang Media Web Digital Signage has four flaws, including cleartext admin credentials

Global · Vulnerability

NVD published 4 vulnerabilities in QiHang Media Web Digital Signage, covering authentication bypass, remote code execution, path traversal and a security flaw. In version 3.0.9, a cleartext credentials flaw lets unauthenticated attackers read administrative login information from an unprotected XML file.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36896), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36897), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36898), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36899), [source](http://www.howfor.com), [source](https://www.exploit-db.com/exploits/48748)

## 2025-12-10: SpinetiX Fusion has four flaws, including an authenticated path traversal

Global · Vulnerability

NVD published 4 vulnerabilities in SpinetiX Fusion, covering path traversal, CSRF, information disclosure and username enumeration. In SpinetiX Fusion Digital Signage 3.4.8 and lower, an authenticated path traversal flaw lets attackers manipulate file backup and deletion operations through unverified input parameters.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36883), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36886), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36887), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36888), [source](https://github.com/Mbed-TLS/mbedtls), [source](https://www.exploit-db.com/exploits/48844)

## 2025-12-10: UBICOD Medivision Digital Signage CSRF flaw lets attackers create administrative accounts

Global · Vulnerability

NVD published 2 vulnerabilities in UBICOD Medivision Digital Signage, covering CSRF and privilege escalation. In version 1.5.1, a cross-site request forgery flaw lets attackers create administrative user accounts without proper request validation.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36901), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36902), [source](http://www.medivision.co.kr), [source](https://www.exploit-db.com/exploits/48694)

## 2025-11-26: Hacked bus stop screens in Israeli cities play Arabic audio and political messages

Ashdod, Ramat Gan and other Israeli cities · Screen hijack

Bus stop screens in several Israeli cities, including Ashdod and Ramat Gan, played Arabic music and spoken Arabic audio around 9 p.m. on November 26, 2025. Times of Israel reported that the messages included remixed audio from Abu Obeida and criticism of Netanyahu and Trump. The Transportation Ministry said a cyber incident was likely and gave no attribution.

Sources: [The Jerusalem Post](https://www.jpost.com/israel-news/article-876347), [The Times of Israel](https://www.timesofisrael.com/to-hell-with-trump-and-netanyahu-hamas-messages-played-from-bus-stop-signs-in-cyberattack/)

## 2025-11-20: Narkom Pyxis Signage has two flaws, including cross-site scripting

Global · Vulnerability

NVD published two vulnerabilities in Narkom Pyxis Signage, covering cross-site scripting and a security flaw. The cross-site scripting entry is an improper neutralization of input during web page generation, filed against Narkom Communication and Software Technologies Trade Ltd.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-0643), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-0645), [source](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0404), [source](https://www.usom.gov.tr/bildirim/tr-25-0404)

## 2025-11-10: Screenly says reported user data leak came from infected devices and reused passwords

Online · Breach

Cloud digital signage vendor Screenly investigated a reported data leak and said in a November 2025 post that its own systems were not the source. The company attributed the exposed data to malware-infected end devices and password reuse from other breached services, and said none of the affected accounts had multi-factor authentication. Screenly responded by moving customers to magic-link sign-in. The account rests on Screenly's own statements.

Sources: [Screenly](https://www.screenly.io/blog/2025/11/10/security-incident-response-magic-links/)

## 2025-11: LA Metro bus stop displays showed a bomb warning after a Papercast compromise

Los Angeles, California, USA · Screen hijack

Several LA Metro bus stop displays briefly showed a bomb warning in place of bus waiting times in late 2025. The messages were later attributed to a compromise of Papercast, the third-party content management system that feeds the displays. The false messages were removed the same day, and an earlier October 2025 incident saw reader boards at LA Metro stops show threatening messages.

Sources: [Sixteen:Nine](https://www.sixteen-nine.net/2025/11/05/hackers-target-la-metros-e-paper-bus-stop-displays/), [Yahoo News](https://www.yahoo.com/news/articles/la-metro-digital-signs-taken-213346738.html)

## 2025-11: Lakewood, Washington mall LED billboard hacked to show Charlie Kirk memes

Lakewood, Washington · Screen hijack

The mall's LED billboard, normally used for store ads, showed memes and doctored images of Charlie Kirk for six or seven hours on a Tuesday evening in November 2025. Police said someone with an agenda was responsible, the sign was shut down, and the owner worked with its vendor to prevent a repeat.

Sources: [KIRO 7](https://www.kiro7.com/news/local/led-billboard-lakewood-displays-bizarre-political-memes-police-blame-hack/2XTCV7WOLBBMJLYOVGD6MQXSHA/)

## 2025-11: Road signs in Encinitas, California hacked to show explicit messages and images

Encinitas, California · Screen hijack

Several variable message signs the city had installed to encourage safer driving were reprogrammed to display profanity, hate speech and explicit images. A resident said the signs were easy to hack and that messages were being sent to the signs. FOX 5 San Diego and KUSI reported it around November 20, 2025.

Sources: [Yahoo News (FOX 5 San Diego and KUSI)](https://www.yahoo.com/news/articles/hacked-road-signs-southern-california-005221958.html), [KPBS](https://www.kpbs.org/news/living/2025/11/26/prankster-hacked-electronic-road-sign-to-display-rude-obscene-messages), [NBC 7 San Diego](https://www.nbcsandiego.com/news/local/encinitas-street-safety-signs-hacked/3935596/)

## 2025-10-14: Airport screens and PA systems in Canada and the US hijacked with pro-Hamas messages

Kelowna, Victoria and Windsor, Canada; Harrisburg, USA · Screen hijack

Intruders reached the terminal information screens and public address system at Kelowna International Airport around 5 p.m. on 14 October 2025. The messages said Hamas had won the war and insulted US President Donald Trump. Staff removed them within minutes, but the intrusion caused some flight delays, and the airport described the intruder only as an unauthorized third party. Similar intrusions were reported at other Canadian airports and at Harrisburg International Airport in Pennsylvania.

Sources: [CTV News](https://www.ctvnews.ca/vancouver/article/flights-delayed-after-bc-airport-hacked-with-pro-hamas-messages/), [Global News](https://globalnews.ca/news/11479402/bc-airports-hacked-pro-hamas-messages-flight-delays), [Torre News](https://torre.news/en/canadian-and-us-airports-hacked-with-pro-hamas-messages), [Jewish News Syndicate](https://www.jns.org/israel-news/pro-hamas-hackers-disrupt-north-american-airports), [Breitbart](https://www.breitbart.com/politics/2025/10/15/display-screens-pa-systems-hacked-with-pro-hamas-messages-at-4-north-american-airports)

## 2025-10-10: Xibo CMS has 2 cross-site scripting vulnerabilities, including stored XSS in v4.1.2

Global · Vulnerability

NVD published 2 vulnerabilities in Xibo CMS, covering cross-site scripting. One is stored XSS in Xibo CMS v4.1.2, caused by a lack of proper validation of user input.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-41088), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-41089), [source](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-xibo-cms)

## 2025-10-02: Ford Dearborn meeting-room screens hacked with anti-return-to-office message

Dearborn, Michigan, USA · Screen hijack

Images on meeting-room screens across Ford's Dearborn offices were replaced with a picture of CEO Jim Farley with a red no symbol over his face and profane anti-return-to-office text. Ford confirmed the incident, removed the image and said it was investigating. No attribution has been reported.

Sources: [The Autopian](https://www.theautopian.com/fk-rto-someone-hacked-the-screens-at-ford-headquarters-to-protest-return-to-work-policy), [The Register](https://www.theregister.com/2025/10/04/ford_rto_hack)

## 2025-10: Citrus Heights traffic sign shows message about Newsom and Prop 50

Citrus Heights, California, USA · Screen hijack

An electronic traffic sign near Fair Oaks Boulevard and Old Auburn Road in Citrus Heights displayed a message about Gov. Gavin Newsom and Proposition 50 for at least two nights. Officials said the sign had been tampered with, and it was unclear who changed the message.

Sources: [CBS Sacramento](https://www.cbsnews.com/sacramento/news/newsom-prop-50-citrus-heights-traffic-sign-message)

## 2025-09-12: Jerusalem junction public screen hacked to show anti-Netanyahu message

Jerusalem, Israel · Screen hijack

The Jerusalem Post reported that a public screen at a key Jerusalem junction was hacked to broadcast an anti-Netanyahu message. The article was published on September 12, 2025.

Sources: [The Jerusalem Post](https://www.jpost.com/israel-news/article-867284)

## 2025-09-12: Street LED screen in Kostanay hacked by schoolboy copying a social media hack

Kostanay, Kazakhstan · Screen hijack

A street LED screen in Kostanay was accessed without authorization by a schoolboy who repeated a hack he had seen on social media. The report says the hack was done for memes.

Sources: [BES.media](https://bes.media/news/shkolnik-v-kostanae-vzlomal-ulichniy-led-ekran-radi-memov-08e63c/)

## 2025-07-23: Samsung MagicINFO Server has 18 vulnerabilities, including path traversal

Global · Vulnerability

NVD published 18 vulnerabilities in Samsung MagicINFO Server, covering path traversal, security flaw and authentication bypass. One path traversal flaw in MagicINFO 9 Server lets an attacker upload a web shell to a web server, and it affects versions below 21.1080.0.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-54438), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-54439), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-54440), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-54441), [source](https://security.samsungtv.com/securityUpdates)

## 2025-06-22: Denver traffic message boards near I-25 show profane anti-ICE message

Denver, Colorado, USA · Screen hijack

On a Sunday in June 2025, electronic traffic boards at the Broadway and I-25 interchange in Denver showed a profane anti-ICE message. Denver's transportation department said someone outside the contractor's team broke the lock on a controller panel and changed the message, and that only one board was hit. Social media users also reported the same message on East Colfax boards two days earlier.

Sources: [Westword](https://www.westword.com/news/hacked-denver-traffic-boards-say-fuck-ice-to-drivers-24883486/)

## 2025-06-08: Nelson Road sign in Longmont, Colorado hacked again to show vulgar message

Longmont, Colorado, USA · Screen hijack

A sign on Nelson Road owned by a contractor was changed on June 8, 2025 to show a vulgar message and was removed the same day. It followed an earlier May 2025 change to a message board near Silver Creek High School. The city treated both as vandalism.

Sources: [The Longmont Leader](https://longmontleader.com/local-news/second-incident-of-a-longmont-sign-hacked-to-display-inappropriate-message-10794383)

## 2025-06: Palm Coast digital road sign on Seminole Woods Boulevard shows explicit phrase

Palm Coast, Florida, USA · Screen hijack

A digital road sign on Seminole Woods Boulevard alternated between a sexually explicit phrase and next right! during a Monday morning on June 30, 2025. The city disabled the message and the Flagler Sheriff Office was notified.

Sources: [Daytona Beach News-Journal (syndicated by Bluewater Healthy Living)](https://bluewaterhealthyliving.com/news/national-news/florida/hacked-digital-road-sign-goes-rogue-in-palm-coast-heres-what-it-briefly-said/)

## 2025-05-29: Longmont variable message board near Silver Creek High School hacked

Longmont, Colorado, USA · Screen hijack

A digital variable message board on Nelson Road near Silver Creek High School in Longmont showed a vulgar message from May 25 to May 28, 2025. The city's public information officer said an unknown party hacked the signing software and changed the message remotely. The board is owned by a contractor working for the city.

Sources: [Longmont Leader](https://www.longmontleader.com/local-news/vulgar-message-displayed-on-longmont-road-sign-in-weekend-vandalism-10731524), [Longmont Leader](https://longmontleader.com/local-news/second-incident-of-a-longmont-sign-hacked-to-display-inappropriate-message-10794383)

## 2025-05-26: Sex-service ad shown on central Astana LED screen

Astana, Kazakhstan · Screen hijack

Residents filmed an LED screen in central Astana showing an ad for sexual services with prices in dollars. Officials said the ad was placed by hacking the screen's Wi-Fi network, and the screen was dismantled and the case referred for a pre-trial investigation.

Sources: [NUR.KZ](https://www.nur.kz/society/2248938-reklamu-seks-uslug-s-cenami-v-dollarah-zasnyali-zhiteli-v-centre-astany-video/)

## 2025-05-22: Samsung MagicINFO 9 Server patch bypass CVE-2025-4632 exploited, sometimes for Mirai

Global · Vulnerability

CVE-2025-4632 is a path traversal flaw in MagicINFO 9 Server that bypassed the August 2024 fix for CVE-2024-7399 and lets attackers write arbitrary files with SYSTEM authority. Attackers began exploiting it shortly after a public proof of concept appeared on April 30, 2025, in some cases to deploy the Mirai botnet. CISA added it to the KEV catalog on May 22, 2025, and Samsung fixed it in version 21.1052.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-4632), [The Hacker News](https://thehackernews.com/2025/05/samsung-patches-cve-2025-4632-used-to.html), [CyberInsider](https://cyberinsider.com/samsung-magicinfo-flaw-now-actively-exploited-by-mirai-botnet/)

## 2025-05-09: Disney World restaurant menu boards altered by fired worker, sentenced to three years

Orlando, Florida, USA · Insider

A former Walt Disney World employee used login access that had never been revoked after he was fired to alter and disable the park's digital menu boards, including a false peanut allergy notice. He was sentenced to three years in prison, according to the criminal complaint and reporting on the case.

Sources: [Sixteen:Nine](https://www.sixteen-nine.net/2025/05/09/fafo-fired-disney-world-manager-gets-three-years-jail-for-monkeying-with-park-menu-boards/), [Bitdefender Hot for Security](https://www.bitdefender.com/en-us/blog/hotforsecurity/fired-disney-worker-hacking-restaurant-menus-replacing-false-peanut-allergy)

## 2025-05-06: BrightSign OS flaw lets code on a player escalate privileges (CVE-2025-3925)

Global · Vulnerability

CISA's ICS advisory ICSA-25-126-03 covers an execution with unnecessary privileges weakness in BrightSign OS series 4 before 8.5.53.1 and series 5 before 9.0.166. CISA scored it 8.5 under CVSS v4 and described it as remotely exploitable with low attack complexity. Once code runs on a player, the flaw can be used for privilege escalation, and the fixed OS releases close it.

Sources: [CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-03), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-3925), [source](https://www.brightsign.biz/resources/software-downloads/)

## 2025-05-06: Samsung MagicINFO 9 Server digital signage flaw exploited by Mirai botnet

Global · Vulnerability

Mirai variants exploited CVE-2024-7399, a path traversal and file upload flaw in on-premise Samsung MagicINFO 9 Server, shortly after a public proof of concept appeared. Arctic Wolf and SANS reported the activity, and Huntress found version 21.1050 still vulnerable to the PoC. Help Net Security reported that a follow-on flaw, CVE-2025-4632, was the one seen in later attacks, and MagicInfo Cloud and VXT customers were not affected.

Sources: [Help Net Security](https://www.helpnetsecurity.com/2025/05/06/exploited-vulnerability-software-managing-samsung-digital-displays-cve-2024-7399/), [The Hacker News](https://thehackernews.com/2025/05/hackers-exploit-samsung-magicinfo.html), [CyberInsider](https://cyberinsider.com/samsung-magicinfo-flaw-now-actively-exploited-by-mirai-botnet/), [SecurityWeek](https://www.securityweek.com/improperly-patched-samsung-magicinfo-vulnerability-exploited-by-botnet/), [Huntress](https://www.huntress.com/blog/rapid-response-samsung-magicinfo9-server-flaw), [Security Affairs](https://securityaffairs.com/177529/hacking/samsung-magicinfo-vulnerability-exploited-after-poc-publication.html), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-7399), [source](https://security.samsungtv.com/securityUpdates), [source](https://arcticwolf.com/resources/blog-uk/arctic-wolf-observes-exploitation-of-path-traversal-vulnerability-in-samsung-magicinfo-9-server-cve-2024-7399/), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-4632), [source](https://security.samsungtv.com/securityUpdates#SVP-MAY-2025), [source](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4632)

## 2025-04: Mary Brown's digital menu boards in Canada taken over

Canada · Screen hijack

Digital menu boards at nearly 300 Mary Brown's restaurants in Canada were taken over and showed unauthorized pro-Palestine messages. The AVIXA industry association cited the case as an example of a signage hack.

Sources: [Sixteen:Nine](https://www.sixteen-nine.net/2025/04/17/that-canadian-qsrs-menu-displays-were-compromised-taken-over-using-phishing/), [Sixteen:Nine](https://www.sixteen-nine.net/2025/04/10/some-300-stores-in-qsr-chain-see-menu-displays-hacked-by-pro-palestine-activists)

## 2025: NovaStar CX40 LED controller overflow and injection flaws (CVE-2025-3007, CVE-2025-3008)

Global · Vulnerability

NovaStar CX40 4K LED controllers at version 2.44.0 and earlier have a stack-based overflow in the NetFilter Utility's netconfig handling (CVE-2025-3007, rated critical). The same utility has a command injection flaw (CVE-2025-3008). Neither had public proof-of-concept code when the database entries were captured.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-3007), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-3008)

## 2025: Xibo CMS module templating flaw allows remote code execution (CVE-2025-62369)

Global · Vulnerability

A code injection flaw in the Module Templating feature of Xibo CMS, reachable from the CMS Developer menu, allows remote code execution in versions up to 4.3.0. Xibo fixed it in 4.3.1, while 4.1 and 4.2 deployments were pointed to upstream patch commits instead of a version upgrade. Feedly reports a public proof-of-concept script on GitHub, which other databases do not mention.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-62369), [INCIBE-CERT](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2025-62369), [source](https://github.com/xibosignage/xibo-cms/commit/0f4e88396111ea027785a48dd8f5eeb14536bd71), [source](https://github.com/xibosignage/xibo-cms/commit/ecd4f9d2cea739a46756a108a839cac80f65cf10)

## 2024-12-29: Honolulu freeway sign shows unauthorized Pride message

Honolulu, Hawaii, USA · Screen hijack

On Sunday, December 29, 2024, drivers saw an unauthorized Pride-themed message on a sign on Moanalua Freeway (H-201). Hawaii DOT disabled the sign, planned to reset it with safety messaging, and began investigating how someone got access. KITV reported the case.

Sources: [KION Central Coast (KITV)](https://kion546.com/?p=1140158)

## 2024-12-13: Seattle Highway 99 portable sign flashes threat about a CEO

Seattle, Washington, USA · Screen hijack

A portable sign on Highway 99 in Seattle flashed a threatening message about a CEO days after the UnitedHealthcare CEO was shot. The sign belonged to a private construction contractor, and the message was gone before SDOT crews arrived. Who tampered with it was not known at the time.

Sources: [Crooks and Liars](https://crooksandliars.com/2024/12/hacker-sends-message-seattle-road-sign)

## 2024-11-27: Astana LED screen shows Ukrainian flag in place of Russian one during Putin visit

Astana, Kazakhstan · Screen hijack

On 27 November 2024, a street LED screen outside the Astana Opera showed the Ukrainian flag instead of the Russian one during Vladimir Putin's visit. The State Technical Service said the image was changed through proxy servers, while the screen owner blamed a cable short, and the Interior Ministry opened a criminal case.

Sources: [Meduza](https://meduza.io/news/2024/11/28/v-astane-vo-vremya-vizita-putina-na-ulichnom-ekrane-vmesto-rossiyskogo-flaga-poyavilsya-ukrainskiy-politsiya-nachala-rassledovanie)

## 2024-10-16: Digital billboard in Moncton hacked to show anti-Israel slogan

Moncton, New Brunswick, Canada · Screen hijack

A digital billboard on Elmwood Drive in Moncton showed a profane anti-Israel message and a Palestinian flag on Wednesday, October 16, 2024. The operator, Pattison Outdoor, called it a malicious hack by an outside party and said it was the only one of its billboards affected, and the local police reported no suspects.

Sources: [CTV News](https://ctvnews.ca/atlantic/article/anti-israel-message-displayed-on-digital-billboard-in-moncton-after-malicious-hack), [NB Media Co-op](https://nbmediacoop.org/2024/10/17/moncton-billboard-hacked-to-show-anti-israel-slogan-attributed-to-youtuber/)

## 2024-10-16: Two Northbrook, Illinois digital billboards hacked with anti-Israel messages

Northbrook, Illinois, USA · Screen hijack

Two electronic billboards in Northbrook were hacked around 5:30 p.m. on October 16, 2024. They showed a Palestinian flag, anti-Israel slogans and a false line saying MrBeast LLC paid for them. Outfront Media, which owns the signs, shut them off and said the copy was not approved and that the signs were hacked. MrBeast's representative said he did not pay for the ad, and police were investigating with no group claiming responsibility in reports found.

Sources: [FOX 32 Chicago](https://www.fox32chicago.com/news/antisemitic-messages-hacked-billboards-northbrook), [Sixteen:Nine](https://sixteen-nine.net/2024/10/17/chicago-highway-billboards-hacked-ads-swapped-for-anti-semitic-messages)

## 2024-10: Construction sign in Phoenix shows profanity and anti-Israel messages

Phoenix, Arizona, USA · Screen hijack

A construction sign near Camelback Road and Interstate 17 in Phoenix showed profanity and anti-Israel messaging early on a Wednesday morning in October 2024. The Department of Public Safety said the sign was not Arizona Department of Transportation property, while Phoenix New Times reported that it belonged to an ADOT contractor.

Sources: [12News](https://12news.com/article/news/local/valley/apparent-hacked-construction-sign-displays-anti-israel-messaging-phoenix-arizona/75-2423c383-bc73-4356-a9d8-0e861b0d9dcd)

## 2024-09-03: Xibo CMS has 2 cross-site scripting vulnerabilities

Global · Vulnerability

NVD published 2 vulnerabilities in Xibo CMS, covering cross-site scripting. Xibo is an open source digital signage platform with a web content management system (CMS).

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-43412), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-43413), [source](https://github.com/xibosignage/xibo-cms/commit/d8f13339469d9f19ce591fb2bd7c9e0e0d2da118), [source](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-336f-wrgx-57gg)

## 2024-08-24: Seattle-Tacoma airport flight and baggage boards knocked out by Rhysida ransomware

Seattle, Washington, USA · Ransomware

Flight and baggage display boards around Seattle-Tacoma International Airport were disrupted when a ransomware attack starting August 24, 2024 took down internet and web systems at the Port of Seattle. Staff used dry-erase boards into the Labor Day weekend. The Port later confirmed Rhysida as the attacker, rejected the ransom demand, and believed sensitive data had been exfiltrated.

Sources: [GeekWire](https://www.geekwire.com/2024/port-of-seattle-outage-continues-three-days-after-suspected-cyberattack-by-nefarious-characters/), [The Record](https://therecord.media/labor-day-travel-seattle-airport-hack)

## 2024-08-23: Connaught Place ad panel in New Delhi shows pornographic video after hack

New Delhi, India · Screen hijack

A municipal ad panel at Connaught Place in New Delhi started showing a pornographic video at about 10:30 p.m. on 23 August 2024. Passers-by filmed it and gave the footage to police, who registered a case under the IT Act. The panel is managed by the New Delhi Municipal Council, and the hacking was later confirmed.

Sources: [SETN](https://www.setn.com/news/1519941), [ThePrint](https://theprint.in/india/porn-video-runs-on-advertisement-board-in-delhis-connaught-place-ndmc-suspects-hacking/2237334)

## 2024-07-14: Faisal Street ad screen in Giza shows video criticizing Sisi

Giza, Egypt · Screen hijack

On the evening of 14 July 2024 a screen on Faisal Street in Giza showed altered images and a slideshow criticizing President Abdel Fattah al-Sisi. Police questioned several people and later said they had arrested a screen technician, though a rights lawyer disputed that this person was the one responsible. The Interior Ministry said it had apprehended the source of the content.

Sources: [The National](https://www.thenationalnews.com/news/mena/2024/07/15/hacker-displays-anti-el-sisi-video-on-big-screen-at-cairo-mall), [The New Arab](https://newarab.com/news/crackdown-egypts-faisal-street-over-anti-sisi-signs), [Middle East Eye](https://www.middleeasteye.net/trending/egypt-social-media-users-applaud-hacked-billboard-anti-sisi-slogans)

## 2024-07: Montreal road construction message boards hacked with pro-Palestinian slogans

Montreal, Quebec, Canada · Screen hijack

Electronic message boards at two Montreal road construction sites showed pro-Palestinian slogans on July 24, 2024. The city said the padlocks were broken and the messages written by hand, the activist group Clash MTL claimed responsibility, and police hate crimes unit looked into it.

Sources: [CTV News Montreal](https://montreal.ctvnews.ca/montreal-electronic-traffic-signs-hacked-to-display-pro-palestinian-political-slogans-1.6976209)

## 2024-07: Xibo CMS DataSet features have SQL injection flaws, CVE-2024-41802 to CVE-2024-41804

Global · Vulnerability

Xibo's July 2024 advisory covered SQL injection flaws in the DataSet features of its CMS, tracked as CVE-2024-41802, CVE-2024-41803 and CVE-2024-41804. The advisory text did not confirm the exact fixed versions.

Sources: [Xibo Signage](https://xibosignage.com/blog/security-advisory-2024-07), [cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2024-41803), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-41802), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-41803), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-41804), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-41944), [source](https://github.com/xibosignage/xibo-cms/commit/b7a5899338cd841a39702e3fcaff76aa0ffe4075), [source](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-x4qm-vvhp-g7c2)

## 2024-06: Electronic construction sign in West Jordan, Utah hacked to show a racist slur

West Jordan, Utah, USA · Screen hijack

An electronic construction sign in West Jordan was broken into and set to display a racist slur, which a driver photographed. West Jordan police are investigating, and the city says the suspects could face vandalism and interfering with a traffic control device charges.

Sources: [KSL.com](https://www.ksl.com/article/51054067/west-jordan-police-investigate-hacked-sign-that-displayed-racist-slur)

## 2024-05-16: Asuncion billboards hacked to show political messages

Asuncion, Paraguay · Screen hijack

Billboards in Asuncion showed political messages after being hacked. The report says the signs were connected to a network that could in principle carry an infection to other networks.

Sources: [ABC Color](https://www.abc.com.py/nacionales/2024/05/16/presuntos-activistas-pro-palestina-hackean-carteles-publicitarios-de-asuncion/)

## 2024-04-25: Cyberattack shuts down KC Scout highway message boards in Kansas City

Kansas City, Missouri, USA · Outage

Highway digital message boards in Kansas City went offline after a cyberattack on April 25, 2024 took down KC Scout, the bi-state traffic service, along with its travel information. Test messages returned to the boards on June 12, and real-time information came back on June 20, after more than a week of testing. The root cause of the attack was not publicized.

Sources: [KCTV5](https://www.kctv5.com/2024/06/11/still-crippled-by-cyberattack-kc-scout-test-initial-phases-restoration/)

## 2024-04: Xibo CMS flaws can lead to session hijacking (CVE-2024-29022, CVE-2024-29023)

Global · Vulnerability

Xibo's April 2024 advisory covered two CMS flaws, CVE-2024-29022 and CVE-2024-29023. The first is a cross-site scripting bug rated 8.8 that can lead to session hijacking, and the second is a token exposure issue rated 7.2. Xibo told users to upgrade to 3.3.10 or 4.0.9, or to the latest release.

Sources: [Xibo Signage](https://xibosignage.com/blog/security-advisory-2024-04), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-29022), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-29023), [source](https://github.com/dasgarner/xibo-cms/commit/a81044e6ccdd92cc967e34c125bd8162432e51bc.diff), [source](https://github.com/xibosignage/xibo-cms/commit/ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff)

## 2024-02-28: Spokane construction sign hacked to warn of 'Angry Raccoons Ahead'

Spokane, Washington, USA · Screen hijack

A construction sign on Northwest Boulevard near Audubon Park displayed Angry Raccoons Ahead during the Wednesday morning commute. The city said a problem with the sign's lock let the message be changed, and no one was identified.

Sources: [Fox News](https://www.foxnews.com/lifestyle/sign-washington-hacked-display-warning-angry-raccoons)

## 2024-02-26: LG webOS Signage code injection and path traversal flaws (CVE-2024-1885, CVE-2024-1886)

Global · Vulnerability

LG published two CVEs for webOS Signage 6.0.0-56 on February 26, 2024: CVE-2024-1885, a code injection flaw that can let a remote attacker run code on the device, and CVE-2024-1886, a path traversal flaw rated 8.8 by NVD. Scores vary across databases for the first one. Databases I checked report no public exploit code for either.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-1885), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-1886), [LG Electronics](https://lgsecurity.lge.com/bulletins), [source](https://lgsecurity.lge.com/bulletins/idproducts#updateDetails)

## 2024-02-24: Minsk public screens reportedly showed Tsikhanouskaya election-eve speech

Minsk, Belarus · Screen hijack

Screens in Minsk shopping centers, supermarkets and metro stations reportedly showed a speech by opposition leader Svyatlana Tsikhanouskaya on the eve of parliamentary and local elections. The number of screens was given as more than 2,000, a figure that could not be verified. The company that maintains the screens denied placing the address.

Sources: [Pozirk](https://pozirk.online/en/news/69358/), [TVP World](https://tvpworld.com/76122807/hackers-broadcast-address-of-opposition-leader-tsikhanouskaya-to-belarusian-people), [Belsat](https://belsat.eu/81245434/dyrektar-legion-104-admaulyae-datychnasts-kampanii-da-razmyashchennya-zvarotu-tsihanouskaj-na-ekranah-u-mensku)

## 2024-01-23: Lev Cinemas screens in Tel Aviv show Gaza war messages, linked to MeshSec hacktivists

Tel Aviv, Israel · Screen hijack

Screens at Lev Cinemas, one of the most frequented cinema chains in Israel, showed messages about the Gaza war projected by hacktivists linked to the Turkish group MeshSec. The attackers reached the screens through a third-party system that updates pre-show clips and trailers. Lev switched off the affected screens, and police opened an investigation.

Sources: [Dark Reading](https://darkreading.com/cyberattacks-data-breaches/hackers-blast-violent-gaza-message-popular-israeli-movie-theater), [SecurityLab.ru](https://www.securitylab.ru/news/545599.php)

## 2024-01-07: Beirut airport flight displays defaced with anti-Hezbollah messages

Beirut, Lebanon · Screen hijack

Hackers defaced several flight information displays at Rafic Hariri International Airport in Beirut on 7 January 2024 with messages critical of Hezbollah and Iran. The intrusion also disrupted the baggage handling system. A Lebanese group named in the messages denied involvement.

Sources: [Hackread](https://www.hackread.com/beirut-airport-screens-hacked-hezbollah-message/), [Graham Cluley](https://grahamcluley.com/hackers-hijack-beirut-airport-departure-and-arrival-boards/), [Urgent Communications](https://urgentcomm.com/2024/01/11/beirut-airport-cyberattack-targets-hezbollah)

## 2024: Eight digital signage products tested by HKCERT have 20 vulnerabilities

Hong Kong · Research

Eight digital signage products tested in October 2024 had 20 vulnerabilities, 11 in web management portals and 9 in the devices, with 10 rated high risk, according to Hong Kong's computer emergency response team. Findings included insecure HTTP, weak encryption, unnecessary open network services, and touch gestures that could exit media players or reach settings. In a live demonstration, control of a display was gained in as little as three seconds. The products are not named in the sources found.

Sources: [HKCERT](https://hkcert.org/blog/enhancing-digital-signage-security-security-findings-and-recommendations-from-the-latest-study), [RTHK](https://news.rthk.hk/rthk/en/component/k2/1788324-20250120.htm)

## 2024: Singapore signage firm Tri-Star Display faces unverified ransomware breach claim

Singapore · Breach

Tri-Star Display, a Singapore display and signage company, was named in a breach claim from a ransomware group. The claim was not independently verified, and the company had not responded to inquiries when the report was published.

Sources: [TEISS](https://www.teiss.co.uk/news/ransomware-group-cicada3301-claims-responsibility-for-tri-star-display-data-breach-14397)

## 2023-10-22: Hitler image shown on Michigan State stadium video board before football game

East Lansing, Michigan, USA · Insider

A Hitler image appeared on the stadium video board during a pregame trivia segment at Michigan State. The university said the content came from a third party, and it suspended an employee with pay pending an investigation. Coverage did not establish how the content reached the board.

Sources: [Michigan State University Athletics](https://msuspartans.com/news/2023/10/22/general-statement-from-michigan-state-university-vice-president-and-director-of-athletics-alan-haller)

## 2023-10-12: Two Tel Aviv smart billboards briefly hijacked to show pro-Hamas footage

Tel Aviv, Israel · Screen hijack

Hackers accessed two smart billboards in or near Tel Aviv and switched the ads for a few minutes. The screens showed anti-Israeli, pro-Hamas footage, according to Check Point.

Sources: [CNBC](https://www.cnbc.com/2023/10/12/billboards-in-tel-aviv-briefly-hacked-to-display-pro-hamas-messages.html)

## 2023-09: Houston electronic construction sign at Montrose and Westheimer hacked with profanity

Houston, Texas · Screen hijack

An electronic construction sign on the corner of Montrose and Westheimer showed a weather message and then a profane one on a Monday in September 2023. Houston Public Works said it did not operate the sign, and a city inspector later switched it off.

Sources: [ABC13 Houston](https://abc13.com/say-what-montrose-digital-construction-sign-altered-to-show-profanity/13771999/), [AOL](https://www.aol.com/hacked-construction-sign-sends-nasty-181846134.html)

## 2023-08-20: Baghdad LED ad screen shows pornographic film, prompting a citywide screen shutdown

Baghdad, Iraq · Screen hijack

A hacker played a pornographic film for several minutes on an LED advertising screen at Uqba bin Nafia Square in Baghdad in August 2023 before the power cable was cut. The interior ministry switched off all screens in the city and set up a committee to investigate. Police arrested the suspect, identified as Karar Hussein, about nine hours later, and he reportedly confessed and blamed a money dispute with the agency that ran the screens.

Sources: [Al-Monitor](https://www.al-monitor.com/originals/2023/08/baghdad-shuts-advertising-screens-after-porn-screening), [Newshub](https://newshub.co.nz/home/world/2023/08/electronic-billboards-in-baghdad-shut-down-after-hacker-broadcasts-pornography.html), [The New Arab](https://www.newarab.com/news/baghdad-shuts-advertising-screens-after-porn-screening), [The Star](https://thestar.com.my/tech/tech-news/2023/08/21/baghdad-shuts-advertising-screens-after-porn-screening)

## 2023-07: Montgomery County construction sign hacked with racist message

Montgomery County, Maryland, USA · Screen hijack

An electronic construction sign in Montgomery County, Maryland, was hacked to display a racist message in July 2023. Police opened a bias investigation and a $10,000 reward was offered for information.

Sources: [FOX 5 DC](https://www.fox5dc.com/news/hacked-sign-racist-message-10k-reward-montgomery-county)

## 2023-05-30: Xibo CMS has 5 vulnerabilities, including remote code execution and SQL injection

Global · Vulnerability

NVD published 5 vulnerabilities in Xibo CMS, covering remote code execution, SQL injection and security flaw. Xibo is a content management system (CMS).

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-33177), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-33178), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-33179), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-33180), [source](https://claroty.com/team82/disclosure-dashboard), [source](https://github.com/xibosignage/xibo-cms/commit/1cbba380fa751a00756e70d7b08b5c6646092658)

## 2023-05-29: Interstate sign near Clanton, Alabama, hacked to show Patriot Front slogans

Clanton, Chilton County, Alabama, USA · Screen hijack

A digital sign on Interstate 65 near Clanton displayed Patriot Front slogans on Memorial Day 2023. The Alabama Department of Transportation said the problem was limited to one contractor's mobile sign that appeared to have been hacked, and that no other message boards on the interstate were affected.

Sources: [The Spokesman-Review](https://www.spokesman.com/stories/2023/may/30/highway-sign-hacked-with-white-supremacist-message/), [Alabama Reporter](https://alreporter.com/2023/05/30/drivers-spot-messaging-from-hate-group-on-i-65-highway-signs), [Yahoo News](https://news.yahoo.com/alabama-highway-sign-hijacked-white-213027572.html)

## 2023-05-17: Orlando digital traffic sign altered to show a threatening anti-gay message

Orlando, Florida, USA · Screen hijack

Orlando police tried to determine who tampered with a digital traffic message board. The board displayed a threat against gay people on International Day Against Homophobia, and Fox 35 reported the case on May 17, 2023.

Sources: [Fox 35 Orlando](https://www.fox35orlando.com/news/traffic-sign-in-orlando-altered-to-display-anti-gay-mesage-police-say), [Yahoo News](https://news.yahoo.com/someone-changed-florida-traffic-sign-111116668.html?fr=sycsrp_catchall)

## 2023-05: Screens in more than 12,000 schools went dark for 41 days after a cyberattack

Germany · Outage

Attackers encrypted the servers, virtual machines and backups at the data center provider used by Heinekingmedia, a German digital signage integrator for schools. Screens in more than 12,000 schools stayed dark for 41 days, and the integrator later moved to two new data center providers. Schools used Samsung screens, but the reporting does not say the attack exploited Samsung software.

Sources: [invidis](https://invidis.com/news/2023/12/cyber-attack-offline-for-41-days/)

## 2023-04-18: Billboards in Yekaterinburg and Rostov-on-Don show antiwar statements

Yekaterinburg and Rostov-on-Don, Russia · Screen hijack

Billboards in Yekaterinburg and Rostov-on-Don showed statements attributed to mobilized soldiers criticizing the war in Ukraine. Security Lab reported that the billboards were compromised by hackers. No group took responsibility in the reports found, and attribution is unconfirmed.

Sources: [SecurityLab.ru](https://www.securitylab.ru/news/537665.php), [Zona Media](https://zona.media/news/2023/04/18/three-billboards)

## 2022-11-22: Brisbane digital billboard hacked to show pornography for several minutes

Brisbane, Queensland, Australia · Screen hijack

A digital billboard on a busy Brisbane road was configured to show pornography for several minutes. Queensland Police said they were searching for the people who had infiltrated the billboard and that the investigation was continuing.

Sources: [The Guardian Australia (via PressReader)](https://www.pressreader.com/australia/the-guardian-australia/20221122/281526525055305), [inkl](https://inkl.com/news/hacked-digital-billboard-in-brisbane-displays-pornography-for-several-minutes), [The Daily Beast](https://www.thedailybeast.com/cops-hunt-hackers-who-hijacked-digital-billboard-to-show-porn-in-brisbane/), [B&T](https://www.bandt.com.au/brisbane-billboard-hacked-in-bonking-bonanza/)

## 2022-10-31: Jacksonville stadium video board shows offensive message referencing Ye

Jacksonville, Florida, USA · Screen hijack

An offensive message referencing Ye, formerly Kanye West, appeared on the exterior video board at TIAA Bank Field after the Florida-Georgia game. The two universities issued a joint statement condemning it. Jacksonville police and the FBI investigated, and reporting said the message appears to have been projected from outside the stadium.

Sources: [Good Morning America](https://goodmorningamerica.com/amp/news/story/antisemitic-message-referencing-kanye-west-displayed-florida-georgia-92387005)

## 2022-09-11: University of Utah touch screen outside Student Life Center shows pornographic sites

Salt Lake City, Utah, USA · Screen hijack

A touch-screen kiosk outside the Student Life Center was compromised around midnight on September 11 and showed multiple pornographic sites over about two days. An employee noticed and reported it, and the kiosk was shut down within the hour. Campus police reviewed surveillance footage, and the university said its other 19 outdoor and about 100 indoor screens were not affected. No arrest is reported in the sources.

Sources: [KSL](https://www.ksl.com/article/50475593/electronic-sign-at-university-of-utah-breached-displayed-pornography-for-2-days)

## 2022-08: Taiwan 7-Eleven and rail displays show political message after contractor breach

Taiwan · Screen hijack

Hackers showed a political message on digital signs at 7-Eleven stores and on railway displays in Taiwan. Investigators said the server of the chain's signage contractor had been compromised, and reports said some 6,000 stores may have been affected.

Sources: [Taipei Times](https://taipeitimes.com/News/taiwan/archives/2022/08/04/2003782956), [Sixteen:Nine](https://www.sixteen-nine.net/?p=33536)

## 2022-05-31: Mall Plaza Buenavista outdoor screen shows adult video in Barranquilla

Barranquilla, Colombia · Screen hijack

An outdoor LED screen at Mall Plaza Buenavista in Barranquilla showed an adult video for several minutes on the afternoon of 31 May 2022. The mall said the screen had been hacked and that unknown people had misused its controls.

Sources: [Colombia.com](https://www.colombia.com/actualidad/nacionales/proyectan-video-sexual-en-pantalla-de-centro-comercial-en-barranquilla-354885)

## 2022-05-27: Santos Dumont airport boarding-area screens show adult clips

Rio de Janeiro, Brazil · Screen hijack

Advertising screens in the boarding area of Rio de Janeiro's Santos Dumont airport showed clips from an adult site instead of ads on May 27, 2022. Infraero, which runs the airport, said the screens belonged to outside advertising companies, that its flight information systems were unaffected, and that it switched the screens off and notified the Federal Police. Passengers reacted with laughter, and some objected because children were traveling.

Sources: [Aviacion al Dia](https://aviacionaldia.com/en/2022/05/rio-de-janeiro-airport-screens-show-pornographic-movies.html), [Udayavani](https://udayavani.com/english-news/hacked-brazil-airport-screens-show-porn-to-travellers), [Tecnoblog](https://tecnoblog.net/noticias/totens-sao-hackeados-para-exibir-pornografia-em-aeroporto-do-rio-de-janeiro/)

## 2022-05: Adult video plays for minutes on LED panel in Montes Claros

Montes Claros, Minas Gerais, Brazil · Screen hijack

A public advertising panel in Montes Claros was hacked and showed a pornographic video for several minutes. The incident was reported in May 2022.

Sources: [Band Minas](https://www.band.com.br/minas-gerais/noticias/hackers-invadem-painel-de-publicidade-e-exibem-video-porno-em-montes-claros-16514888)

## 2022-03: Maryland State Police road sign on Route 40 in Hagerstown hacked with racist message

Hagerstown, Maryland, USA · Screen hijack

A Maryland State Police electronic message sign on Route 40 at Smithfield Lane was reprogrammed to display a racist message. The lock on the display box had been pried open, troopers disabled the sign and removed it, and state police investigated the incident as a hate crime.

Sources: [CBS Baltimore](https://www.cbsnews.com/baltimore/news/electronic-road-sign-in-hagerstown-hacked-to-beam-racial-slur-authorities-say)

## 2022-03-01: Moscow-area EV charging stations go offline and screens show anti-Putin text

Moscow region, Russia · Screen hijack

Public EV charging stations outside Moscow went offline in what looked like a hack. Their screens showed anti-Putin text and the slogan Glory to Ukraine. The attack came in early 2022, around the start of Russia's full-scale invasion.

Sources: [Sixteen:Nine](https://invidis.com/sixteen-nine/2022/03/01/hackers-appear-to-have-disabled-russian-ev-chargers-leaving-anti-putin-messages/), [InsideEVs](https://insideevs.com/news/570958/russia-electric-car-chargers-hacked/)

## 2022-02-15: Digital display outside Tropical Park in Miami hacked with political messages

Miami, Florida, USA · Screen hijack

Officials confirmed that an electronic message board outside Tropical Park in Miami-Dade County was hacked after profanity-laced political messages about Biden appeared on it. WSVN reported the confirmation in February 2022.

Sources: [WSVN 7News](https://wsvn.com/news/local/miami-dade/officials-digital-display-that-flashed-anti-biden-messages-outside-tropical-park-was-hacked/)

## 2022: Phoenix freeway sign on I-17 hacked with message about Putin

Phoenix, Arizona, USA · Screen hijack

A portable electronic board near Interstate 17 in Phoenix was hacked to show a message about Vladimir Putin, the second time in 24 hours. Arizona DPS said a separate Phoenix sign case did not involve ADOT's freeway message system. Phoenix New Times covered the incident in February 2022.

Sources: [Phoenix New Times](https://www.phoenixnewtimes.com/news/hacked-highway-sign-in-phoenix-condemns-vladimir-putin-13101927)

## 2021-11: Two privately owned signs in Oakleaf, Florida, hacked with racist messages

Oakleaf, Clay County, Florida, USA · Screen hijack

Two privately owned electronic signs in Oakleaf were hacked overnight and showed racist messages in place of free COVID testing ads. One sat near Oakleaf High School and the other in a community park lot, and deputies disabled both after a 911 call.

Sources: [News4JAX](https://www.news4jax.com/news/local/2021/11/18/clay-county-deputies-remove-racial-slurs-from-electronic-signs)

## 2021-10-18: Every school display in an Illinois district hijacked by a high school student

Illinois, USA · Screen hijack

A high school student in Illinois took over the networked displays in every school in the district and played a single song on them. The case was reported as a warning to anyone running networked digital signage.

Sources: [Invidis / Sixteen-Nine](https://www.sixteen-nine.net/?p=30782), [Sixteen:Nine / invidis](https://invidis.com/2021/10/18/high-school-student-hacks-entire-school-districts-screens-then-rickrolls-viewers/)

## 2021-10-06: Cisco Vision Dynamic Signage Director has a cross-site scripting flaw

Global · Vulnerability

NVD published a cross-site scripting vulnerability in Cisco Vision Dynamic Signage Director. A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface on an affected device.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-34742), [source](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvdsd-xss-fvdj6HK)

## 2021-07-09: Iranian railway station boards show fake cyberattack delay and cancellation notices

Nationwide, Iran · Screen hijack

On a Friday in July 2021, hackers posted fake messages on passenger display boards at stations across Iran saying trains were delayed by a cyberattack or cancelled, and listed a phone number for the office of the supreme leader. The state railway spokesman said trains ran normally and that there was no disruption, while Fars reported "unprecedented chaos" before removing the report. No group claimed responsibility.

Sources: [Security Affairs](https://securityaffairs.com/119942/hacking/irans-railroad-system-cyberattack.html), [Sixteen:Nine](https://www.sixteen-nine.net/?p=21942), [Dawn](https://dawn.com/news/1634287/hackers-disrupt-irans-rail-service-with-fake-delay-messages), [Sixteen:Nine / invidis](https://invidis.com/sixteen-nine/2021/07/13/passenger-rail-info-screens-hacked-in-iran-travelers-see-faked-messaging-times/), [Dawn](https://www.dawn.com/news/1634287), [VOA News](https://www.voanews.com/a/middle-east_voa-news-iran_hackers-disrupt-irans-rail-service-fake-delay-messages/6208078.html)

## 2021-07: Flight screens at two Venezuelan airports show insult aimed at Maduro

Maiquetia and Porlamar, Venezuela · Screen hijack

Flight information screens at Simon Bolivar airport in Maiquetia and Santiago Marino airport in Porlamar showed "Maduro dictador" for several minutes on a Tuesday in July 2021. The Sebin and DGCIM intelligence services opened an investigation.

Sources: [El Tiempo](https://www.eltiempo.com/mundo/venezuela/hackearon-pantallas-de-aeropuerto-con-mensaje-contra-nicolas-maduro-601910)

## 2021-07: Garden Highway electronic sign in Sacramento hacked with Fourth of July message

Sacramento, California, USA · Screen hijack

An electronic sign along Garden Highway, which had been showing a closure notice, was hacked overnight to wish drivers a happy Fourth of July, with the greeting ending in profanity. The sign was changed back afterward.

Sources: [CBS Sacramento](https://www.cbsnews.com/amp/sacramento/news/garden-highway-hacked-sign-4th-of-july)

## 2021-06-11: Denver construction sign hacked to show political messages

Denver, Colorado, USA · Screen hijack

Someone hacked a digital construction sign in Denver's RiNo district to show political messages, including messages about police and a call to burn things down. KRDO reported the case in June 2021.

Sources: [KRDO](https://krdo.com/news/2021/06/11/hacked-construction-sign-in-denver-says-abolish-cops-and-burn-it-down/)

## 2021-04-10: KAIST physics building display defaced with Black Joker image

Daejeon, South Korea · Screen hijack

On the morning of 10 April 2021 the electronic display on the physics department building at KAIST was defaced. The screen, which normally showed a department introduction, showed the attacker's name and a black-and-white Joker image.

Sources: [Boan News](https://m.boannews.com/html/detail.html?idx=96403)

## 2021-01: Digital road sign in Flour Bluff hacked

Corpus Christi, Texas, USA · Screen hijack

Someone hacked a digital road sign in the Flour Bluff area of Corpus Christi, according to the city's Roads Department. The sign drew attention on social media before crews fixed it.

Sources: [KRIS 6 News](https://www.kristv.com/news/local-news/flour-bluff-digital-road-sign-hacked)

## 2020-10-08: Cisco Vision Dynamic Signage Director flaw exposes data and allows config changes

Global · Vulnerability

NVD published a security flaw in Cisco Vision Dynamic Signage Director. A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to access confidential information or make configuration changes.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-3598), [source](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvdsd-missing-auth-rQO88rnj)

## 2020-09-23: Cisco Vision Dynamic Signage Director REST API endpoint allows authentication bypass

Global · Vulnerability

NVD published an authentication bypass vulnerability in Cisco Vision Dynamic Signage Director. A vulnerability in the REST API endpoint of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected device.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-16004), [source](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-vdsd-auth-bypass)

## 2020-08-26: Cisco Vision Dynamic Signage Director has 4 flaws, including privilege escalation

Global · Vulnerability

NVD published 4 vulnerabilities in Cisco Vision Dynamic Signage Director, covering security flaw, privilege escalation, path traversal and cross-site scripting. A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to view potentially sensitive information on an affected device.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-3484), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-3485), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-3490), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-3491), [source](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vdsd-W7mnkwj7), [source](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cvdsd-rbac-y9LM5jw4)

## 2020-07-16: Cisco Vision Dynamic Signage Director flaw allows SQL injection

Global · Vulnerability

NVD published a SQL injection vulnerability in Cisco Vision Dynamic Signage Director. A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative credentials to conduct SQL injection attacks on an affected system.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-3450), [source](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-visio-dir-sql-inj-fPm3MPfT)

## 2020-01: Kentucky roadwork sign on KY 92 hacked to say 'send nudes'

Pine Knot, Whitley County, Kentucky, USA · Screen hijack

A digital roadwork sign on Highway 92 in Whitley County displayed 'SEND NUDES' instead of its normal warning in January 2020. Officials said the hacker got past the sign's password protection, the sign was turned off quickly, and the contractor said none of its staff were involved.

Sources: [WDRB](https://www.wdrb.com/news/hacked-kentucky-road-sign-asks-drivers-to-send-nudes/article_7ba5f1b0-331d-11ea-a72a-b38a601495fe.html), [WBIR](https://www.wbir.com/article/traffic/digital-roadwork-sign-along-ky-92-hacked-in-whitley-county-to-say-send-nudes/51-bf9fa0d5-b395-43fd-9139-5bba93e99fc3), [Fox 29](https://www.fox29.com/news/send-nudes-drivers-shocked-by-road-signs-racy-request)

## 2020: Norwalk, Connecticut digital road sign hacked with a political message

Norwalk, Connecticut, USA · Screen hijack

A digital road sign in Norwalk displayed a political message. The state transportation department said the sign was hacked and that the sign had come from an outside vendor. The sign was shut down and reset once crews found the message.

Sources: [News 12 Connecticut](https://connecticut.news12.com/dont-vote-joe-trump-2020-norwalk-digital-road-sign-hacked-dot-says-42539609)

## 2019-12-14: Chosun Ilbo ad screen in Busan's Seomyeon shows a mocking message

Seomyeon, Busan, South Korea · Screen hijack

On 14 December 2019 an outdoor ad screen in Seomyeon, Busan, operated for Chosun Ilbo, showed a message mocking the newspaper. The operator halted the screen for an internal review. Police arrested a teenager in December 2020, a year later, and charged him under the Information and Communications Network Act.

Sources: [Ilyo Sisa](https://www.ilyosisa.co.kr/news/article.html?no=212916), [WikiTree](https://www.wikitree.co.kr/articles/489206), [Boan News](https://m.boannews.com/html/detail.html?idx=85201), [Youth Assembly](https://www.youthassembly.kr/news/580072)

## 2019-10: Bloomington construction sign hacked with messages protesting police armored vehicle

Bloomington, Indiana, USA · Screen hijack

An electronic construction sign at South Woodlawn Avenue and East Grimes Lane in Bloomington was hacked one morning in 2019 to display messages protesting the city's purchase of an armored vehicle for police. Activists had been pressing the city to stop the purchase.

Sources: [Indiana Public Media (WFIU/WTIU)](https://www.ipm.org/2019-11-01/bloomington-construction-sign-hacked-show-messages-protesting-armored-vehicle-151725)

## 2019-09-29: Asics Auckland store screens show pornography for hours

Auckland, New Zealand · Screen hijack

Promotional screens above Asics' central Auckland store ran pornography on a Sunday morning in late September 2019 until staff switched them off around 10 a.m. Estimates of the run time range from two hours to nine. Asics blamed an unknown person who gained access to the screens, apologised, and contacted police and Netsafe, and police said no cybercrime report had been filed with them.

Sources: [1News](https://www.1news.co.nz/2019/09/29/auckland-sportswear-store-apologises-to-people-who-saw-porn-video-on-stores-screen), [Inside Retail](https://insideretail.co.nz/2019/10/01/hackers-upload-porn-video-on-asics-promotional-screens/)

## 2019-09-28: I-75 billboard in Auburn Hills shows pornographic video after two people hacked it

Auburn Hills, Michigan, USA · Screen hijack

On the night of September 28, 2019, a pornographic video played on a northbound I-75 digital billboard in Auburn Hills, Michigan, for an estimated 15 to 30 minutes. Police said two people broke into an unstaffed shed under the billboard and hacked a computer inside, and the operator stopped the video remotely. One later report said two teenagers were charged after video of the break-in was reviewed, though only one source mentions this.

Sources: [WXYZ](https://www.wxyz.com/news/police-2-people-broke-into-shed-hacked-into-computers-to-put-pornography-on-billboard), [Loop Insight](https://loopinsight.com/2019/10/01/two-suspects-break-into-control-room-put-porn-on-highway-digital-billboard), [International Business Times](https://www.ibtimes.com/michigan-billboard-plays-porn-30-minutes-after-pair-breaks-shack-hacks-computer-2837254)

## 2019-07-17: Cisco Vision Dynamic Signage Director flaw allows authentication bypass

Global · Vulnerability

NVD published an authentication bypass vulnerability in Cisco Vision Dynamic Signage Director. A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-1917), [source](http://www.securityfocus.com/bid/109301), [source](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth)

## 2019-03: Mirai variant targets LG Supersign signage TVs and WePresent presentation systems

Global · Malware

Palo Alto Networks Unit 42 reported a Mirai variant that carried 27 exploits, 11 of them new to Mirai, aimed at enterprise devices. Two were business display products: LG Supersign signage TVs (exploit for CVE-2018-17173) and WePresent WiPG-1000 wireless presentation systems. The payload was reportedly hosted on a compromised website in Colombia, and the variant also targeted routers, NVRs and IP cameras.

Sources: [Palo Alto Networks Unit 42](https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/), [Help Net Security](https://www.helpnetsecurity.com/2019/03/19/mirai-new-tricks/)

## 2019-02-11: Tightrope Carousel signage appliance shipped with a default admin login

Global · Research

Researcher Drew Green found that the Tightrope Media Carousel Seneca HDn signage appliance, version 7.0.4.104, shipped with a default local admin username and password that was still in use on a client system. He used that access and a bulletin upload feature to reach remote code execution, and also reported a privilege escalation path to SYSTEM. He reported the issues to Tightrope in November 2018, published about 90 days later, and used Shodan to estimate exposed installations, though the search count is not in the excerpt available; Tightrope published a knowledgebase article with workarounds.

Sources: [Sixteen Nine / Invidis](https://invidis.com/sixteen-nine/2019/02/11/cybersecurity-researcher-finds-severe-vulnerabilities-in-digital-signage-platform/), [Sophos Naked Security](https://news.sophos.com/?p=439023), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-18929), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-18930), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-18931), [source](https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/)

## 2018-09-14: Bristol Airport flight screens go dark after ransomware infection

Bristol, United Kingdom · Ransomware

Ransomware infected the computers that drive Bristol Airport's in-house screens showing arrival and departure information on 14 September 2018, and the screens stayed dark for about two days. Staff used handwritten whiteboards and extra PA announcements. The airport said flights were not affected, that it would not pay the ransom, and the ransomware variant was never publicly identified.

Sources: [Dark Reading](https://www.darkreading.com/attacks-breaches/ransomware-takes-down-airports-flight-information-screens-/d/d-id/1332826), [CSO Online](https://www.csoonline.com/article/3305750/ransomware-hits-uks-bristol-airport-affects-flight-information-screens.html), [ESET WeLiveSecurity](https://www.welivesecurity.com/2018/09/17/bristol-airport-apparent-ransomware-attack/), [ESET Ireland blog](https://blog.eset.ie/2018/09/19/bristol-airport-takes-flight-screens-offline-after-apparent-ransomware-attack/), [The Register](https://www.theregister.com/2018/09/17/bristol_airport_cyber_attack), [The Hacker News](https://thehackernews.com/2018/09/cyberattack-bristol-airport.html)

## 2018-09: Pornographic video shown on billboard at busy Santo Domingo intersection

Santo Domingo, Dominican Republic · Screen hijack

A sexual video was broadcast on a billboard at a busy intersection in the Dominican capital on a weekday morning. Police and prosecutors opened an investigation into whether the devices had been accessed illegally.

Sources: [The Clinic](https://www.theclinic.cl/2018/09/24/condoro-muestran-por-error-video-porno-en-pantalla-publicitaria/)

## 2018-07-23: Tightrope Carousel digital signage has a path traversal vulnerability

Global · Vulnerability

NVD published a path traversal vulnerability in Tightrope Carousel. A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-14573), [source](http://release-notes.trms.com/txt/448)

## 2018-07-15: Pornographic video replaces ads on Clear Channel screen in central Madrid

Madrid, Spain · Screen hijack

A digital advertising screen owned by Clear Channel at Calle Preciados 13 began showing pornographic footage in place of its ads on a Sunday evening. Police covered the screen and firefighters switched it off.

Sources: [Vozpopuli](https://www.vozpopuli.com/actualidad/video-porno-pantalla-publicidad-hackeada-madrid_0_1154585882.html)

## 2018-07: Electronic message sign in Woodbridge shows 'We have taken control' message

Woodbridge, Virginia, USA · Screen hijack

An electronic message sign in front of Marumsco Plaza in Woodbridge displayed 'This is a message from Fed Solar. We have taken control.' Potomac Local reported it in July 2018, and the message was not one the sign's operator had put up.

Sources: [Potomac Local](https://www.potomaclocal.com/?p=117164)

## 2018-04: Arizona highway sign near Queen Creek altered to show an offensive message

Pinal County, Arizona, USA · Screen hijack

An electronic sign on Hunt Highway near Queen Creek was altered to show an offensive message in late April 2018. The sign belonged to a private company, and deputies could not turn it off without the password, so county crews covered it for several hours until it was shut down.

Sources: [FOX 10 Phoenix](https://www.fox10phoenix.com/news/pro-hitler-message-appeared-on-electronic-road-sign)

## 2018-04: Two Yagan Square touchscreens in Perth showed the Pornhub homepage

Perth, Australia · Screen hijack

Two touchscreen wayfinding signs at the William Street Mall entrances of Yagan Square in Perth showed the Pornhub homepage in April 2018 and stayed that way for about an hour. The operator, the Metropolitan Redevelopment Authority, first blamed a software fault that left the browser unlocked, then said content had been manually loaded, and it switched both displays off. Reporting differed on whether this was a hack, and no outcome of an investigation was published.

Sources: [iTnews](https://www.itnews.com.au/news/attackers-take-over-perths-yagan-square-touchscreens-488446), [Vice](https://www.vice.com/en/article/hackers-broadcast-pornhub-homepage-in-the-heart-of-perth/)

## 2018-03-20: Makati digital billboard shows pornographic video, operator blames attack

Makati, Philippines · Screen hijack

A pornographic video played on a digital billboard at the Executive Building Center in Makati on March 20, 2018. The operator, Globaltronics, called it a malicious attack on its system, and Mayor Abby Binay ordered the board shut pending an investigation by the city and the National Bureau of Investigation.

Sources: [Inquirer News](https://newsinfo.inquirer.net/977066/makati-digital-billboard-porn-pornography-globaltronics-air-incident/amp), [GMA News](https://www.gmanetwork.com/news/news/metro/647364/makati-mayor-operator-of-digital-billboard-that-showed-porn-clip-claimed-its-system-hacked/story/), [The Philippine Star](https://www.philstar.com/nation/2018/03/22/1799034/nation)

## 2018: Jacksonville stadium jumbotron hacked by former Jaguars contractor after firing

Jacksonville, Florida, USA · Screen hijack

Prosecutors say the stadium's jumbotron controls were hacked by a former contractor, a registered sex offender the Jaguars fired in January 2018, who installed remote access software on a spare server. The video boards malfunctioned repeatedly during three games that season. He was convicted in November 2023 and sentenced to 220 years in March 2024.

Sources: [U.S. Department of Justice](https://www.justice.gov/usao-mdfl/pr/jumbotron-hacker-and-prolific-child-molester-sentenced-220-years-federal-prison), [AP via KVIA](https://kvia.com/news/ap-national/2023/11/17/convicted-sex-offender-found-guilty-of-hacking-jumbotron-at-the-jacksonville-jaguars-stadium/), [KSL.com](https://www.ksl.com/article/50962509), [JaxToday](https://jaxtoday.org/2024/03/26/jags-jumbotron-hacker-a-sex-offender-gets-220-years-in-prison/)

## 2018: Mashhad airport screens in Iran defaced with a political statement

Mashhad, Iran · Screen hijack

Hackers defaced the screens at Mashhad airport in Iran with a statement criticising the Islamic Revolutionary Guard Corps and its regional activities. Security Affairs reported the defacement, but the exact date within 2018 was not confirmed in the available reporting.

Sources: [Security Affairs](https://securityaffairs.com/72969/hacktivism/mashhad-airport-defacement.html?amp=1)

## 2017-12-18: BrightSign players have 3 disclosed flaws, including cross-site scripting

Global · Vulnerability

NVD published three vulnerabilities in BrightSign players, covering cross-site scripting, a security flaw and path traversal. The BrightSign Digital Signage (4k242) player, firmware 6.2.63 and below, has XSS via the REF parameter to /network_diagnostics.html or /storage_info.html.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17737), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17738), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-17739), [source](http://www.information-paradox.net/2017/12/brightsign-multiple-vulnerablities-cve.html), [source](https://www.exploit-db.com/exploits/43364/)

## 2017-11-21: Auckland road sign hacked with a crude message

Auckland, New Zealand · Screen hijack

A road sign in Auckland flashed a crude message on a Tuesday morning during the school run. No one claimed responsibility. Stuff, which published the story through Newshub, reported it on November 21, 2017.

Sources: [Newshub (Stuff)](https://www.newshub.co.nz/home/new-zealand/2017/11/auckland-road-sign-hacked-with-dirty-message.html)

## 2017-11: Georgia high school cafeteria TV plays pornographic video during lunch

Clayton County, Georgia, USA · Screen hijack

A pornographic video played for about a minute on cafeteria TV monitors at a Clayton County high school during lunch before the principal stopped it. Hackread said the cause was unclear. The district said a student would be disciplined.

Sources: [Hackread](https://www.hackread.com/school-cafeteria-tv-monitor-plays-porn-leaving-kids-baffled/)

## 2017-11: York Region electronic sign on Bayview Avenue in Aurora, Ontario, shows profanity

Aurora, Ontario, Canada · Screen hijack

A York Region electronic sign near St. John Sideroad, meant to show a closure notice, instead displayed profanity overnight. Officials turned off three signs, altered a fourth, and disabled remote access to all York Region electronic signs while staff investigated.

Sources: [Global News](https://globalnews.ca/news/3886768/aurora-sign-hack)

## 2017-08-02: Large outdoor screen in Cardiff shopping district taken over by hackers

Cardiff, Wales, UK · Screen hijack

Hackers took control of a large outdoor screen in the middle of Cardiff's shopping district and broadcast swastikas, images referencing Islam, and a photo of Donald Trump as Pepe the Frog. The Next Web reported the attack in August 2017.

Sources: [The Next Web](https://thenextweb.com/insider/2017/08/02/hackers-take-control-large-outdoor-screen-cardiff-broadcast-offensive-messages/), [The Register](https://www.theregister.com/2017/08/02/welsh_electronic_billboard_hacked/), [International Business Times UK](https://www.ibtimes.co.uk/digital-billboard-cardiff-hacked-show-swastikas-memes-sharia-zone-warning-1633197)

## 2017-08: Caltrans sign on I-80 near UC Davis hacked with an insulting message about Trump

Davis, California, USA · Screen hijack

A sign on eastbound Interstate 80 near UC Davis displayed an insulting message about Trump on a Wednesday night in early August 2017. Caltrans said it was investigating how the message was changed, and the sign was later fixed.

Sources: [Raw Story](https://www.rawstory.com/2017/08/hackers-break-into-california-road-sign-so-it-flashed-trump-has-herpes/)

## 2017-06-27: NotPetya ransomware hits Kyiv Boryspil airport, passengers told to check scoreboard

Kyiv, Ukraine · Ransomware

The NotPetya ransomware outbreak hit Boryspil International Airport in Kyiv on 27 June 2017. Passengers were told to check departure times on the terminal D scoreboard and the airport website, and operations were back to normal by 28 June. The sources read do not say exactly which airport systems the malware took down beyond this.

Sources: [Daily Sabah](https://www.dailysabah.com/europe/2017/06/27/ukraines-state-institutions-banks-main-airport-media-hit-by-major-cyber-attack)

## 2017-06-01: Buenos Aires LED screen hacked to show explicit images and an insult to Macri

Belgrano, Buenos Aires, Argentina · Screen hijack

An LED screen at Cabildo and Mendoza in Belgrano was hacked to show images from an erotic website, along with a message insulting then-president Mauricio Macri. Local outlets reported the attack in June 2017.

Sources: [Diario de Cuyo](https://diariodecuyo.com.ar/argentina/Hackearon-una-pantalla-con-una-pelicula-porno-e-insultos-a-Macri-20170601-0007.html), [Perfil](https://www.perfil.com/noticias/sociedad/hackearon-una-pantalla-gigante-para-proyectar-porno-y-macri-gato.phtml)

## 2017-05-29: Liverpool One shopping centre screen taken over to show a security warning

Liverpool, England, UK · Screen hijack

A screen among the 18 digital displays run by Elonex at Liverpool One was taken over that weekend, around 29 May 2017, and showed a message about weak security, signed by "friendly neighbourhood hackers". The mall shut the screen down, and the operator called it good-natured. Security researcher Kevin Beaumont later posted images showing several screens still offline the next day, which the mall disputed, and the culprit was never identified.

Sources: [Silicon](https://silicon.co.uk/security/hackers-billboard-liverpool-213417/amp), [Digital Signage Today](https://www.digitalsignagetoday.com/news/hackers-target-digital-signage-in-liverpool-england/), [The Next Web](https://thenextweb.com/news/friendly-neighborhood-hackers-spoof-digital-billboard-local-mall)

## 2017-05-13: Tiong Bahru Plaza mall directory screen shows WannaCry ransomware message

Singapore · Ransomware

A ransomware message appeared on the digital directory at Tiong Bahru Plaza on Saturday 13 May 2017, photographed by a shopper and posted to Reddit and Facebook. The directory operator, MediaOnline, disconnected the boards while it installed a patch, and said the directory ran on its own network, not the malls' or tenants' networks. Reports also said screens at White Sands and a Desigual store at Orchard Central were hit.

Sources: [Sixteen:Nine](https://www.sixteen-nine.net/?p=14687), [IBTimes Singapore](https://www.ibtimes.sg/wannacry-virus-hits-singapore-malls-number-breaches-reported-10073)

## 2017-05-12: WannaCry ransom text appears on Deutsche Bahn station information screens

Germany · Ransomware

During the global WannaCry outbreak, Deutsche Bahn reported that some electronic arrival and departure signs at its stations were infected. Passenger information screens showed a text demanding ransom money. Train operations were not affected, and the company said its security team found the infection early.

Sources: [Railway News](https://railway-news.com/global-cyber-attack-hits-deutsche-bahn)

## 2017-05: Union Station touch-screen ad board played pornographic videos at rush hour

Washington, D.C., USA · Screen hijack

A touch-screen advertising board near the Metro entrance at Washington Union Station played pornographic videos during rush hour in May 2017. Station management said the screen had been hacked but did not give details.

Sources: [WTOP](https://wtop.com/dc/2017/05/union-station-ad-screen-played-porn-videos), [CBS News](https://www.cbsnews.com/news/porn-plays-on-screen-during-rush-hour-in-d-c-s-union-station)

## 2017-04: Construction sign near University of Nevada, Reno changed to read 'Send Nudes'

Reno, Nevada, USA · Screen hijack

Hackers changed a construction warning sign on North Virginia Street near the University of Nevada, Reno in April 2017 so that 'slow down' read 'send nudes'. The sign belonged to a contractor building student housing, and the culprit was never publicly identified.

Sources: [Associated Press via The Washington Times](https://www.washingtontimes.com/news/2017/apr/15/hackers-change-construction-sign-at-unr-to-encoura/)

## 2017-03: Mexico City billboard hacked to broadcast pornographic video

Mexico City, Mexico · Screen hijack

A digital billboard owned by Grupo Carteleras on a busy road was hijacked to play a pornographic video for a few minutes. Hackread said footage showed a TeamViewer warning tab, which suggests remote-access software was used, and the owner acknowledged the hack and contacted law enforcement.

Sources: [Hackread](https://hackread.com/mexico-billboard-hacked-with-porn-video)

## 2016-11-26: San Francisco Muni station screens show 'You Hacked' message in ransomware attack

San Francisco, California, USA · Ransomware

Ransomware hit San Francisco's Muni transit computer systems on 26 November 2016, and station screens displayed "You Hacked, ALL Data Encrypted". Fare gates were affected, and riders got free rides for the day. A person who may have spread the malware reportedly asked for $73,000.

Sources: [CBS News San Francisco](https://www.cbsnews.com/amp/sanfrancisco/news/you-hacked-cyber-attackers-crash-muni-computer-system-across-sf), [METRO Magazine](https://www.metro-magazine.com/news/san-franciscos-muni-hacked-in-ransomware-attack), [Route Fifty](https://route-fifty.com/cybersecurity/2016/11/san-francisco-latest-victim-of-ransomware/298143), [CSO Online](https://www.csoonline.com/article/3144991/ransomware-forces-sfmta-to-give-free-rides-73-000-demanded-by-attackers.html), [IT Security Guru](https://www.itsecurityguru.org/2016/11/28/san-franciscos-muni-transit-system-reportedly-hit-by-ransomware/)

## 2016-11-22: Fair Park electronic sign in Dallas hacked to show anti-Trump message

Dallas, Texas, USA · Screen hijack

An electronic sign at Fair Park in Dallas was hacked to show an anti-Trump message in November 2016. The Dallas Morning News covered the incident.

Sources: [The Dallas Morning News](https://dallasnews.com/news/2016/11/22/electronic-sign-at-fair-park-hacked-to-show-profane-anti-trump-message)

## 2016-11-02: Lake Ridge, Virginia road sign hacked with a message about Clinton and Trump

Lake Ridge, Virginia, USA · Screen hijack

Police in Lake Ridge, Virginia said someone changed the text of a road sign to show a political message about Hillary Clinton and Donald Trump. WJLA reported the case in November 2016.

Sources: [WJLA](https://wjla.com/news/local/road-sign-hacked-to-say-crooked-hillary-is-a-expletive-vote-trump)

## 2016-10: Chicago construction signboard hacked with an insulting message about Mayor Emanuel

Chicago, Illinois, USA · Screen hijack

A construction signboard at Grand and Central Avenues in Chicago flashed an insulting message about Mayor Emanuel on and off for about an hour in October 2016. Investigators concluded the sign had been hacked, and no suspect was named in the reporting.

Sources: [Hackread](https://www.hackread.com/construction-sign-hacked-message-for-rahm-emanuel/)

## 2016-09-30: South Jakarta roadside LED screen plays pornographic video at rush hour

Jakarta, Indonesia · Screen hijack

A pornographic video played for several minutes on a roadside LED screen in South Jakarta during afternoon rush hour in September 2016, and officials cut its power. Police arrested a 24-year-old IT worker who said he had photographed the screen's login and password, though police could not find that photo on his phone and the operator's account conflicted with his, so the story is unverified. He faced up to six years under the criminal code and the electronic information law.

Sources: [NPR](https://www.npr.org/sections/thetwo-way/2016/10/05/496706040/man-faces-prison-over-porn-video-that-played-on-roadside-billboard-in-jakarta), [The Jakarta Post](https://www.thejakartapost.com/news/2016/10/05/police-nab-hacker-over-jumbotron-porn), [Khaosod English](https://www.khaosodenglish.com/news/asean/2016/10/05/man-arrested-hacking-indonesian-billboard-japanese-porn/)

## 2016-09-06: Digital traffic sign on West Campus in Austin hacked to show Harambe tribute

Austin, Texas, USA · Screen hijack

A digital traffic sign in the West Campus area near the University of Texas was hacked to show a message commemorating Harambe, the gorilla killed at the Cincinnati Zoo in 2016. The Daily Texan reported the incident.

Sources: [The Daily Texan](https://thedailytexan.com/2016/09/06/digital-traffic-sign-in-west-campus-hacked-with-message-commemorating-harambe/)

## 2016-07-29: Flight screens and PA systems at two Vietnam airports hijacked with political messages

Ho Chi Minh City and Hanoi, Vietnam · Screen hijack

Hackers took over flight information screens and public address systems at Tan Son Nhat (Ho Chi Minh City) and Noi Bai (Hanoi) airports on 29 July 2016. The screens showed political messages tied to the South China Sea dispute instead of schedules, and the Vietnam Airlines website was defaced. Vietnamese authorities said flight operations and security systems were unaffected and ordered tighter aviation security.

Sources: [The Himalayan Times](https://thehimalayantimes.com/ampArticle/167406), [VOA News](https://www.voanews.com/a/flight-info-screens-at-vietnam-major-airports-hacked/3441118.html), [The Register](https://www.theregister.com/2016/08/01/vietnam_flight_info_hack/), [Sixteen:Nine](https://www.sixteen-nine.net/?p=12703), [Sixteen:Nine / invidis](https://invidis.com/sixteen-nine/2016/08/01/hackers-take-over-digital-signage-audio-at-vietnam-airports/)

## 2016-07: Digital advertising screens in Brussels hacked to show anti-TTIP messages

Brussels, Belgium · Screen hijack

Several electronic advertising screens in Brussels were hacked during the 14th round of TTIP negotiations in July 2016, and anti-TTIP messages were left on them. A large Coca-Cola screen was among those manipulated, and the action was reported at the Place de Brouckere.

Sources: [netzpolitik.org](https://netzpolitik.org/2016/ttip-protest-werbetafeln-in-bruessel-gehackt/), [RTBF](https://www.rtbf.be/article/des-activistes-anti-ttip-ont-pirate-le-panneau-publicitaire-de-brouckere-a-bruxelles-9351010)

## 2016-05-31: Digital construction signs hacked on I-30 in Dallas

Dallas, Texas, USA · Screen hijack

Digital sign hackers targeted a construction site at I-30 and Cockrell Hill in Dallas in late May 2016. CBS Texas reported the case the same week.

Sources: [CBS Texas](https://www.cbsnews.com/amp/texas/news/traffic-signs-hacked-on-north-texas-roads)

## 2016-05-23: Highway construction sign in Cedar Park, Texas changed via guessed login, man arrested

Cedar Park, Texas, USA · Screen hijack

Geoffrey Eltgroth, 26, of central Texas, changed the construction warning on an electronic message board to read 'Drive Crazy Y'all.' He told investigators he guessed the sign's username and password and changed the message because he thought it was funny. He was arrested in May 2016, and the charge was reported differently across outlets.

Sources: [The Dallas Morning News](https://www.dallasnews.com/news/crime/2016/05/23/central-texas-man-says-he-changed-highway-sign-to-drive-crazy-yall-for-a-laugh), [Sophos](https://news.sophos.com/en-us/2016/05/24/man-hacks-highway-sign-to-read-drive-crazy-yall/?amp=1)

## 2016-05-09: Digital panel near Malmo central station hijacked to show pornographic clips

Malmo, Sweden · Screen hijack

A digital information panel near Malmo central station showed several clips from the Meatspin porn site at once around 15:47 in May 2016, and bystanders said they ran for at least 10 to 15 minutes. The screen was run by Global Agencies for the City of Malmo, which said it started an investigation. Reports differ on whether the device was a city panel at a bus stop or a street sign, and no one was reported arrested.

Sources: [The Drum](https://www.thedrum.com/news/2016/05/09/digital-ad-panel-hacked-broadcast-hardcore-meatspin-porn-malm), [The Media Leader](https://uk.themedialeader.com/swedish-billboard-hijacked-by-porn)

## 2016-04-24: Yeosu bus stop information terminal plays adult video for about 70 minutes

Yeosu, South Korea · Screen hijack

On the night of 24 April 2016 an adult video played for roughly 70 minutes on a bus information terminal in Seogyo-dong, Yeosu, until a city employee cut its power. City officials and police treated it as a hack, and reports said malware and hacking traces were found on the terminal's memory card. Reports also said the terminal had no firewall and ran on a leased line.

Sources: [Sidae](https://www.sidae.com/article/2016042616038020170)

## 2016-02-27: QNAP Signage Station flaws include file upload and authentication bypass

Global · Vulnerability

NVD published 4 vulnerabilities in QNAP Signage Station, covering file upload, authentication bypass, hard-coded credentials and privilege escalation. Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file, and then accessing this file via an unspecified URL.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-6022), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-6036), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-7261), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-7262), [source](http://www.kb.cert.org/vuls/id/444472)

## 2016-02: Austin traffic sign hacked to read 'OU Still Sucks'

Austin, Texas, USA · Screen hijack

A digital traffic sign at Rio Grande and 24th Street near the University of Texas campus was hacked overnight to show OU Still Sucks, a week after Oklahoma's men's basketball team beat Texas. KXAN reported the incident, and no charges were reported in the sources read.

Sources: [The Dallas Morning News](https://dallasnews.com/sports/oklahoma-sooners/2016/02/16/texas-oklahoma-rivalry-goes-to-the-next-level-with-hacked-traffic-sign)

## 2016-01-15: Kyiv subway ad screens show Sherlock villain Moriarty images

Kyiv, Ukraine · Screen hijack

Hackers replaced ad screens in Kyiv subway cars with images of Moriarty, the Sherlock Holmes villain, in January 2016. The metro's press service said it had not sanctioned the placement and was investigating. Coverage treated it as a playful stunt that still raised security questions.

Sources: [Global Voices](https://globalvoices.org/2016/01/15/miss-me-witty-hackers-put-sherlock-villain-moriarty-on-kyiv-subway-screens/)

## 2016-01-13: Tan Son Nhat airport screens compromised to show inappropriate content

Ho Chi Minh City, Vietnam · Screen hijack

A group of hackers compromised the display system at Tan Son Nhat International Airport in January 2016, according to an airport manager quoted by Tuoi Tre. Inappropriate content appeared on the screens that normally show flight information and advertising. This was an earlier incident than the July 2016 attack on Vietnamese airports.

Sources: [Tuoi Tre News](https://tuoitrenews.vn/news/society/20160113/hackers-break-into-computers-at-ho-chi-minh-city-airport/38778.html)

## 2016: Shop-window monitors at a Munich pharmacy show pornographic video

Munich, Germany · Screen hijack

Pornographic video ran at night on three monitors in the shop window of the Cleemann pharmacy in Munich during the Oktoberfest period, and the pharmacy owner filed a complaint. According to the reporting, the attacker logged in with credentials that were shown on screen between ad spots and then changed the content remotely.

Sources: [APOTHEKE ADHOC](https://www.apotheke-adhoc.de/nachrichten/detail/apothekenpraxis/schaufensterwerbung-diese-woche-mal-kein-porno/), [PC-WELT](https://www.pcwelt.de/?p=1161743)

## 2015-12: Brussels' largest electronic billboard hacked to show a troll-face image

Brussels, Belgium · Screen hijack

Hackers entered a building in Brussels, went up to the top floor and got into the computer that controlled what was described as Belgium's largest electronic billboard. They replaced a drinks advertisement with a troll-face image and the text 'Hi BXL'. Passers-by reportedly welcomed the stunt, but the Brussels municipality objected.

Sources: [Son Dakika](https://www.sondakika.com/guncel/haber-belcika-da-reklam-panosu-hacklendi-8010696/)

## 2015-09: Lille city centre information panels hijacked to show crude messages

Lille, France · Screen hijack

A hacker took over the information panels in Lille city centre in late summer 2015 and displayed crude messages. He cut the display after about 10 seconds, long enough to film a video, and said he had no political motive.

Sources: [Le Tribunal du Net](https://www.letribunaldunet.fr/videos/un-hacker-pirate-les-panneaux-a-lille-et-voila-ce-quil-affiche-dessus.html)

## 2015-08-12: All screens at Curitiba's Boqueirao bus station show pornographic videos

Curitiba, Brazil · Screen hijack

Pornographic videos ran for about 15 minutes on every screen at the Boqueirao bus station in Curitiba during Friday afternoon peak hours in August 2015. One account says the attackers replaced arrival and departure times with adult content. Police cyber crime staff tried to trace the attackers, and the company operating the screens was told to improve its security.

Sources: [SecurityWeek](https://www.securityweek.com/hackers-broadcast-porn-tv-screens-brazil-bus-depot/), [Sophos News](https://news.sophos.com/en-us/2015/08/12/x-rated-videos-shown-on-hacked-brazilian-bus-station-screens/?amp=1)

## 2015-07-03: Tucson traffic sign hacked to read 'Zombies ahead' and a nuclear spill warning

Tucson, Arizona, USA · Screen hijack

A digital traffic sign on Pantano Road in Tucson read 'Zombies ahead' and 'nuclear fall-out truck spill, turn around now.' KOLD published the report in July 2015.

Sources: [KOLD News 13](https://www.kold.com/story/29466781/tucson-digital-traffic-sign-hacked-warns-of-zombies-ahead?outputType=amp)

## 2015-05: Buckhead, Atlanta video billboard hijacked to show a sexually explicit image

Atlanta, Georgia, USA · Screen hijack

A video billboard at Peachtree and East Paces Ferry Road in the Buckhead district of Atlanta showed a sexually explicit image of a naked man in May 2015. Police first considered an insider prank, then concluded someone had hacked the board from outside over the internet, and cut power to stop the image. The FBI also investigated the incident.

Sources: [Rough Draft Atlanta](https://roughdraftatlanta.com/2015/05/13/atlanta-police-investigating-hacked-billboard-sign-that-flashed-photo-of-naked-man/), [WABE](https://www.wabe.org/fbi-atlanta-police-investigating-buckhead-billboard-hack/), [Graham Cluley](https://grahamcluley.com/hackers-obscene-electronic-billboard/)

## 2015-01: Downtown Los Angeles LED traffic sign hacked to show a profane message

Los Angeles, California, USA · Screen hijack

A portable LED traffic sign at South Hope Street and West 4th in Bunker Hill was changed to show a profane message. The sign belonged to Traffic Management Incorporated, which said it was likely broken into physically. The person responsible was never identified.

Sources: [Electric Literature](https://electricliterature.com/l-a-traffic-sign-hacked-to-say-read-a-fucking-book/)

## 2014-05: Five North Carolina DOT electronic road signs hacked to show 'Hack by Sun Hacker'

North Carolina, USA · Screen hijack

Five NCDOT electronic signs displayed Hack by Sun Hacker on a Friday morning, in locations including Asheville, Winston-Salem and Carolina Beach Road. The messages were up for less than five minutes, NCDOT replaced them and reviewed its sign security, and the FBI looked into the case.

Sources: [Associated Press (via The Washington Times)](https://m.washingtontimes.com/news/2014/may/31/computer-hacker-hits-electronic-road-signs-in-nc/)

## 2014-05: Van Ness Avenue traffic sign in San Francisco hacked to warn of a Godzilla attack

San Francisco, California · Screen hijack

A mobile electronic traffic sign on Van Ness Avenue was altered to warn drivers of a "Godzilla Attack" and to turn back. The sign was meant to carry Bay to Breakers traffic notices, and a Twitter user suggested the hacker had used default passcodes.

Sources: [CBS News](https://www.cbsnews.com/news/godzilla-attack-s-f-traffic-sign-hacked-to-warn-drivers)

## 2014-01-29: Xibo CMS SQL injection, cross-site scripting and CSRF flaws disclosed

Global · Vulnerability

NVD published 3 vulnerabilities in Xibo CMS, covering SQL injection, cross-site scripting and CSRF. SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-4887), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-4888), [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-4889), [source](http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html), [source](http://www.securityfocus.com/bid/62071)

## 2014: Daktronics Vanguard highway sign software shipped with a default password

Global · Vulnerability

ICS-CERT alert ICS-ALERT-14-155-01 warned that Daktronics Vanguard dynamic message sign software used a default password that let attackers reach highway signs over a network. Daktronics said the password was a default that operators can change at installation, and the update told operators to change it and to keep the displays on private networks. Coverage in June 2014 described the issue as an easy way to hack federal highway signs.

Sources: [CISA](https://www.cisa.gov/news-events/ics-alerts/ics-alert-14-155-01), [Nextgov](https://nextgov.com/cybersecurity/2014/06/flaw-lets-hackers-control-electronic-highway-billboards/85849)

## 2013-10-02: Xibo CMS path traversal flaw lets remote attackers read arbitrary files

Global · Vulnerability

NVD published a path traversal vulnerability in Xibo CMS. Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files using directory traversal sequences in a request.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-5979), [source](http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-%28DS-2013-00), [source](https://bugs.launchpad.net/xibo/+bug/1093967)

## 2013-07: Kensington Parkway road sign in Maryland hacked to say Smoke Weed Evryday

Kensington, Maryland, USA · Screen hijack

A sign on Kensington Parkway that normally showed congestion and detour messages was hacked to read Smoke Weed Evryday. The sign belonged to D and F Construction, which was working for Montgomery County, and was deactivated and reprogrammed after the county police learned of the change.

Sources: [CBS News](https://www.cbsnews.com/news/smoke-weed-electronic-road-sign-in-md-hacked-report-says)

## 2013-05: Roadwork sign on Highland Avenue in Madison hacked to read Zombies Ahead

Madison, Wisconsin, USA · Screen hijack

A traffic sign on Highland Avenue near UW Hospital was hacked on a Monday morning to read Zombies Ahead. The owner, Mega Rentals, said the attacker must have opened the equipment and used the handheld unit, which suggests physical access rather than a remote attack.

Sources: [FOX6 Milwaukee](https://www.fox6now.com/news/web-fix-hacked-zombies-ahead-sign-warns-drivers-in-madison)

## 2012-11: Northern California road sign in Loomis hacked to warn of a loose gorilla

Loomis, California, USA · Screen hijack

An electronic road sign in Northern California was hacked to read 'Caution: loose gorilla.' Fox News published the story on November 20, 2014.

Sources: [Fox News](https://www.foxnews.com/us/electronic-road-sign-hacked-to-read-caution-loose-gorilla-in-northern-california.print)

## 2012-10-25: New York road sign changed to read 'Zombies Ahead'

New York, USA · Screen hijack

A New York road sign was changed to read 'Zombies ahead.' State transportation officials said they were not amused. Claims Journal reported the incident on October 25, 2012.

Sources: [Claims Journal](https://amp.claimsjournal.com/news/east/2012/10/25/216124.htm)

## 2012-08-09: Provo, Utah road sign hacked to show an anti-gay message

Provo, Utah, USA · Screen hijack

An electronic road sign in Provo was hacked in early August 2012 and programmed to flash an anti-gay message. KUER reported the message on August 9, 2012.

Sources: [KUER](https://www.kuer.org/news/2012-08-09/provo-road-sign-hacked-to-read-anti-gay-message)

## 2012-01-13: Richmond VDOT sign hacked to warn of zombies

Richmond, Virginia, USA · Screen hijack

A VDOT sign on Old Gun Road in Richmond read 'Zombies Ahead' and 'Increased speed ahead.' WTVR reported the defacement in January 2012.

Sources: [WTVR](https://www.wtvr.com/2012/01/13/zombies-ahead-warns-hacked-vdot-sign)

## 2011-03-21: South Carolina Highway 160 sign flashes 'Zombies Ahead'

South Carolina, USA · Screen hijack

A changeable road sign on Highway 160 in South Carolina, which normally posted construction and crash warnings, flashed 'Zombies Ahead' and 'Watch for Hunters.' CBS News covered the sign in March 2011.

Sources: [CBS News](https://www.cbsnews.com/news/zombies-ahead-road-sign-taunts-south-carolina/)

## 2010-01: Moscow Garden Ring video billboards show a pornographic clip, halting traffic

Moscow, Russia · Screen hijack

A pornographic clip played on video billboards along Moscow's Garden Ring Road in mid-January 2010, halting traffic as drivers and pedestrians filmed it. Police identified Igor Blinnikov, 41, who said he broke into the server of the ad agency that ran the billboards and picked a random video; he called it a joke that went wrong. Sentence reports conflict, with one saying 18 months and another six years, and the incident led the Moscow Advertising Committee to ban video billboards on city streets.

Sources: [The Moscow Times](https://themoscowtimes.com/archive/hacker-arrested-in-billboard-porn-stunt), [The Register](https://www.theregister.co.uk/2011/03/24/russian_billboard_smut_hacker_jailed/), [NBC News](https://www.nbcnews.com/news/amp/wbna34881029)

## 2009-06-12: Giant screen at Berlin's O2 World arena allegedly hacked to advertise a party

Berlin, Germany · Screen hijack

Video appeared to show people breaking into a giant screen at the O2 World arena in Berlin to advertise a party. Stadium officials did not believe the footage proved the screen was manipulated. The stunt was reported as an alleged hack.

Sources: [The Local](https://www.thelocal.com/20090612/19895)

## 2009-01-29: Austin road sign hacked to read 'Zombies Ahead'

Austin, Texas, USA · Screen hijack

A changeable road sign at Lamar and MLK in Austin showed 'Zombies Ahead' one morning in January 2009 in place of its normal construction warning. The city owns the sign, and TxDOT said its own signs were not affected. A hacking site linked to the prank featured the same message.

Sources: [BetaNews](https://betanews.com/2009/01/29/digital-road-sign-hacked-to-read-zombies-ahead)

## 2008-11-05: firmCHANNEL Digital Signage cross-site scripting flaw lets remote attackers inject script

Global · Vulnerability

NVD published a cross-site scripting vulnerability in firmCHANNEL Digital Signage. Cross-site scripting (XSS) vulnerability in the account module in firmCHANNEL Digital Signage 3.24, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php.

Sources: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2008-4931), [source](http://osvdb.org/49564), [source](http://secunia.com/advisories/32549)

## 2008-08-10: Outdoor digital billboard networks were the subject of a DEF CON 16 hijacking talk

Las Vegas, USA · Research

Outdoor digital billboards, which had begun showing several advertisers on one board, were the subject of a DEF CON 16 talk titled "Hijacking the Outdoor Digital Billboard Network," which argued they were attractive targets to take apart and tinker with. Billboard Insider's write-up of the talk lists weaknesses including unencrypted network links open to packet sniffing and war dialing, and global or default usernames and passwords. A conference listing dates the talk to 2008, while one secondary source dates it to 2013, so the 2008 listing is the one used here.

Sources: [InfoConDB](https://infocondb.org/con/def-con/def-con-16/hijacking-the-outdoor-digital-billboard-network), [Billboard Insider](https://billboardinsider.com/hacking-digital-billboards/)

## 2006-05-02: Toronto GO Transit LED train signs reprogrammed with insulting message about PM

Toronto, Canada · Screen hijack

Scrolling LED signs on GO Transit trains around Toronto showed an insulting message about Stephen Harper for several days in May 2006. A GO spokesman said the signs were programmed with an infrared remote and had no password protection when installed about six years earlier, and transport officials planned to password-protect 790 signs. The sign operator, Exclusive Advertising, said GO Trains had not authorized the message, and the perpetrator was not identified in the sources read.

Sources: [Computerworld](https://www.computerworld.com/article/1689763/hacker-hits-toronto-transit-message-system-jabs-prime-minister.html), [The Register](https://www.theregister.co.uk/2006/05/03/canadian_train_sign_hack/), [NBC News](https://www.nbcnews.com/news/amp/wbna12598242)