The hacker group calling itself Leakers has claimed responsibility for the recent compromise of LED screens in Kluang, Johor, saying the attack was intended to expose serious security weaknesses in internet-connected display infrastructure rather than make money. The incident resulted in obscene video content being shown on a public LED screen two days earlier, prompting action from local authorities and police.
According to the group, Kluang was not an isolated target. Leakers claims it has also compromised systems in several other countries, including Egypt, Iraq, Brazil and China, after identifying vulnerable display-management infrastructure through automated internet scanning.
Leakers Says Billboards Were Not Specifically Targeted
The group claims that public advertising billboards were not deliberately selected as its primary targets. Instead, its members reportedly discovered vulnerabilities in software used to transfer and manage content shown on LED displays.
Once those weaknesses were identified, the group says it was able to gain control of affected systems and change what appeared on connected screens. This suggests the attackers were targeting vulnerable software and management platforms rather than choosing individual billboard operators in advance.
The affected screens were essentially the visible consequence of vulnerabilities discovered in the underlying infrastructure.
Security Flaws Were Allegedly Found In Display Management Software
Leakers claims that the software used to manage and transfer content to LED screens contained several vulnerabilities. According to the group, some of the weaknesses could be exploited directly through webpages and interfaces exposed by the system itself.
If accurate, this would mean attackers did not necessarily need sophisticated physical access to the displays. Internet-accessible management interfaces may have provided enough exposure for vulnerable systems to be identified and compromised remotely.
The claims have not yet been independently confirmed by investigators, so the exact technical weaknesses involved remain unclear.
Automated Scanning Was Used To Find Vulnerable Systems
Rather than manually searching for individual companies, Leakers says it relied on automated scanning to identify exposed systems across the internet.
The group claims it was able to discover thousands of vulnerable systems within approximately two hours. This suggests the attackers were looking for a particular software configuration or exposed service that could be detected automatically.
Once vulnerable systems were found, the group could then attempt to exploit them without necessarily knowing which organisation or country operated the screen beforehand.
The Group Claims Countries Were Not Selected In Advance
Leakers says its attacks were not specifically aimed at Malaysia or the Kluang Municipal Council. According to the group, vulnerable systems were discovered first, and their geographical locations only became relevant after access was obtained.
This would explain why the group claims similar activity across several unrelated countries. Rather than conducting a campaign against one government or organisation, the attackers appear to portray their activity as opportunistic exploitation of whatever vulnerable display systems they could find.
That distinction remains part of the group's own explanation and has not yet been confirmed by law enforcement.
Leakers Says Its Objective Was To Expose Weak Cybersecurity
The group insists its purpose was not financial. It claims that it was not trying to extort organisations, request donations or deploy ransomware against affected infrastructure.
Instead, Leakers says the attacks were intended to demonstrate how easily poorly secured digital display networks could be taken over.
The group criticised organisations that spend large amounts of money deploying digital infrastructure while allegedly leaving management systems exposed without sufficient basic cybersecurity protections.
The Group Criticised Poorly Protected Infrastructure
Leakers argued that infrastructure providers should be held accountable when internet-connected displays remain accessible through vulnerable systems.
Its central claim is that an attacker should not be able to gain control of public screens simply by finding exposed software on the internet. The group says the ease with which it discovered vulnerable installations demonstrates a broader security problem rather than an exceptionally sophisticated attack technique.
According to its statement, the purpose of taking over the screens was to prove that control could be obtained in real time.
Attackers Reject The Idea That The Incident Was Highly Sophisticated
The group also criticised suggestions that incidents of this type should automatically be described as highly sophisticated or state-sponsored cyberattacks.
Leakers instead claims that poor infrastructure security made the compromises relatively straightforward. In its view, the vulnerability of the affected systems is more significant than the sophistication of the attackers.
That argument does not excuse unauthorised access or the decision to display obscene material, but it does highlight a familiar cybersecurity problem: exposed systems can become easy targets regardless of how unimportant they may appear.
Public LED Screens Can Still Be Serious Cybersecurity Targets
Digital billboards may appear less important than banking systems, government databases or corporate servers, but modern LED displays are frequently connected to remotely managed infrastructure.
Content may be uploaded through web interfaces, cloud platforms or central management servers. Those systems can contain administrative accounts, remote-access services and software that needs to be maintained just like any other internet-connected technology.
If the management platform is compromised, attackers can potentially control every display connected to it.
The Kluang Incident Demonstrated The Public Impact
The consequences of a digital signage breach are immediately visible. Instead of quietly accessing data in the background, attackers can place content directly in public spaces where motorists, pedestrians and nearby residents can see it.
That visibility makes public screens attractive targets for attackers seeking attention. A compromised billboard effectively becomes a large public broadcasting platform controlled by whoever has gained access.
In Kluang, the unauthorised content involved an obscene video, turning what may have begun as a software vulnerability into a highly visible public incident.
Police Have Opened Two Investigation Papers
Police have since opened two investigation papers connected to the Kluang LED screen incident.
Kluang district police chief Assistant Commissioner Bahrin Mohd Noh said authorities received a report from a 42-year-old man who had been informed about the incident through WhatsApp.
Investigations are continuing as authorities attempt to determine who was responsible and how the digital signage system was compromised.
The Case Is Being Investigated Under Two Laws
The incident is being investigated under Section 4(1) of the Computer Crimes Act and Section 292 of the Penal Code.
The Computer Crimes Act investigation relates to the unauthorised access or interference involving computer systems, while the Penal Code provision concerns obscene material.
The combination reflects the two main elements of the incident: the compromise of digital infrastructure and the content displayed after access was obtained.
Kluang Municipal Council Previously Confirmed The Hack
Majlis Perbandaran Kluang had already confirmed that its LED display system was compromised. The breach resulted in an obscene video being shown through at least one of the affected screens.
Following the incident, the council shut down its LED display infrastructure while investigations and security reviews were carried out.
The shutdown was intended to prevent further unauthorised content from appearing until the systems could be examined and secured.
The Exact Vulnerability Has Not Been Publicly Confirmed
Although Leakers has claimed that vulnerable content-management software was responsible, authorities have not yet publicly confirmed the exact technical cause.
Investigators and the system vendor will need to determine whether the breach involved a software vulnerability, weak authentication, an exposed management portal or some combination of several weaknesses.
Until that investigation is complete, the group's own technical explanation should be treated as a claim rather than a confirmed finding.
This distinction is important because attackers do not necessarily provide complete or accurate descriptions of how they gained access.
Automated Scanning Makes Exposed Systems Easy To Find
One of the most important lessons from the group's account is how quickly vulnerable internet-connected infrastructure can be discovered.
Attackers no longer need to know that a particular company operates a certain system before searching for it. Automated scanners can search enormous ranges of internet addresses for specific services, software versions or exposed interfaces.
Once a vulnerability becomes known, thousands of systems can potentially be identified in a relatively short period.
This is why simply assuming an obscure management interface will go unnoticed is no longer a realistic security strategy.
Security Through Obscurity Is Not Enough
Some organisations may assume that attackers will not bother looking for digital signage systems because those systems are relatively specialised.
Automated scanning completely changes that equation. A vulnerable service can be discovered regardless of whether anyone specifically knows the organisation exists.
If software exposes a recognisable interface or service to the internet, automated tools can potentially find it.
The safest approach is therefore to secure the system properly rather than relying on obscurity to keep it hidden.
Display Management Interfaces Should Not Be Publicly Exposed Without Need
Remote management is useful because administrators and vendors can update billboard content without physically visiting every location.
However, administrative interfaces should not be openly accessible from anywhere on the internet unless there is a compelling requirement. Access can instead be restricted through VPN connections, trusted IP addresses or dedicated management networks.
Reducing exposure dramatically lowers the number of attackers capable of interacting with the system.
Even if the underlying software contains a vulnerability, limiting who can reach it provides another barrier.
Strong Authentication Remains Essential
Digital signage administrators should also avoid default passwords, weak credentials and shared accounts.
Every management account should use a strong, unique password, while multi-factor authentication should be enabled wherever the platform supports it.
Administrators should also review which accounts still need access and remove credentials belonging to former employees or vendors.
A management platform controlling several public screens deserves the same basic identity protections applied to more conventional IT systems.
Vendors Need To Keep Management Software Updated
If the vulnerability is ultimately confirmed to exist in the signage software itself, patch management will become another important part of the incident.
Digital signage platforms can remain deployed for years, making it easy for software versions to fall behind if nobody is actively maintaining them.
Organisations should know which versions are installed, whether the vendor still supports them and how quickly security patches are applied.
A display that continues functioning normally may still be running software containing years of unpatched vulnerabilities.
Centralised Systems Can Create A Large Blast Radius
When several screens share one management platform, compromise of that platform can potentially affect every connected display.
Centralised management is operationally convenient because administrators can update many billboards from one location. The trade-off is that the central system becomes a particularly valuable target.
A single compromised account or vulnerable server could give an attacker control over multiple screens at once.
Security architecture should therefore assume that the central management platform is critical infrastructure.
Network Segmentation Can Limit Further Damage
Digital signage should also be separated from sensitive organisational networks whenever possible.
If attackers gain access to a billboard controller, they should not automatically be able to reach finance systems, employee computers or other municipal infrastructure.
Network segmentation creates boundaries that make lateral movement more difficult.
Even systems considered low-value should be isolated if they have internet connectivity and remote-management capabilities.
Monitoring Could Detect Future Attacks Earlier
Administrators should also monitor digital signage platforms for unexpected logins, unusual uploads and content changes occurring outside normal operating hours.
Alerts could be triggered whenever media is replaced, new administrator accounts are created or remote access originates from unfamiliar locations.
These controls may not prevent every attack, but they can significantly reduce the time an attacker remains undetected.
With public billboards, rapid detection matters because every minute of unauthorised display time increases the number of people exposed to the content.
The Attackers' Claimed Motive Does Not Make The Intrusion Legitimate
Leakers says its objective was to expose vulnerabilities rather than make money, but that does not turn unauthorised access into legitimate security testing.
Responsible vulnerability research generally involves reporting weaknesses to the affected vendor or organisation rather than taking over public infrastructure and displaying unauthorised content.
The decision to broadcast obscene material also created consequences for members of the public who had nothing to do with the security problem.
Claiming an educational motive therefore does not remove the impact of the intrusion.
There Is A Difference Between Disclosure And Public Exploitation
Security researchers regularly find serious vulnerabilities and demonstrate their impact without compromising unrelated production systems.
A responsible disclosure process gives vendors an opportunity to correct the problem before details are made public. Public exploitation takes a very different approach by proving the vulnerability through an actual compromise.
The latter may attract much more attention, but it also creates legal, ethical and operational consequences.
The Kluang incident falls firmly into the category of unauthorised exploitation rather than ordinary vulnerability disclosure.
The Incident Could Encourage Other Councils To Review Their Systems
Other local authorities operating similar LED displays should use the incident as an opportunity to review their own infrastructure.
If the same management software is widely used, vulnerabilities could potentially exist across multiple installations.
Organisations should review internet exposure, account security, software versions and remote-access controls before another attacker discovers the same weaknesses.
Waiting until inappropriate content appears on a public screen is an unnecessarily expensive way to discover that security was inadequate.
Public Infrastructure Is Becoming Increasingly Digital
The incident also reflects a broader change in municipal infrastructure. Signs, cameras, traffic systems, building controls and public information displays are increasingly connected to networks and managed remotely.
This creates enormous operational benefits but also increases the number of systems that need cybersecurity protection.
Devices that were once completely standalone can now become entry points for remote attackers.
Cybersecurity planning therefore needs to expand beyond conventional office computers and servers.
Every Connected Device Creates Another Attack Surface
An internet-connected billboard may not contain confidential financial information, but it still provides another interface that attackers can probe.
The value of a target is not always determined by the data stored inside it. Some attackers want visibility, disruption or simply the ability to demonstrate control.
Public displays are particularly attractive because successful compromise is immediately visible.
That means even relatively mundane infrastructure deserves proper hardening and monitoring.
Final Thoughts
The hacker group calling itself Leakers claims the Kluang LED screen breach was part of a wider campaign intended to expose weak security in internet-connected display systems rather than generate financial profit.
According to the group, it exploited vulnerabilities in software used to manage LED content and identified affected systems through automated scanning. Leakers claims thousands of vulnerable installations were discovered within only two hours, with compromised systems appearing across countries including Malaysia, Egypt, Iraq, Brazil and China.
The group argues that the incidents demonstrate how poorly secured public infrastructure can be controlled remotely, although its exact claims about the vulnerabilities have not yet been independently confirmed.
Police have now opened two investigation papers in connection with the Kluang incident, which is being investigated under the Computer Crimes Act and the Penal Code. Majlis Perbandaran Kluang had already confirmed that its LED display system was hacked after obscene content appeared publicly.
Regardless of the attackers' claimed motive, the incident highlights a straightforward cybersecurity lesson. Public LED displays may look like simple screens, but the systems behind them are connected computers with management software, administrator accounts and network interfaces.
If those systems are exposed to the internet without strong authentication, patching, segmentation and monitoring, automated scanners can eventually find them.
The biggest warning from the Kluang incident is therefore not that one hacker group can control a billboard. It is that the group claims finding vulnerable infrastructure was easy enough to automate — and if that is confirmed, the next attacker may have very different intentions.
Comments 0