On a digital menu board, a price is content. It sits in a template, goes into a playlist and appears on every screen that playlist reaches. Anyone with the right access to the content management system can change it, so menu board security begins with knowing who holds that access.
In the first week of November, someone with that access raised the prices on a German restaurant’s menu boards.
According to invidis, the digital signage system of a German franchisee of a well-known quick-service restaurant chain was compromised that week. The attackers reportedly guessed a weak default password and got into the CMS. The change went unnoticed inside the business. It was found when customers saw unexpectedly higher prices on the menu boards.
The reports do not name the chain, the CMS vendor or the hardware. Digital Signage Magazine adds that they also leave out how long the altered prices were live. invidis judged the likely damage as customer complaints, harm to the brand and possible lost revenue.
The entry point is the part every operator can act on. invidis describes it as a guessed credential and mentions no software flaw or hardware tampering.
Two other cases with the same question
A week earlier, on Thursday, October 29, the outdoor digital sign at South Franklin Elementary School in Carnesville, Georgia, showed a pornographic image during morning drop-off. Now Georgia reports that it was up for a few minutes before parents alerted the school and officials turned the sign off.
According to a letter to parents reported by 11Alive, an investigation found a breach in the external system of the company that operates the board. Two nearby businesses using the same signs had similar incidents that morning. In nearby Royston, a bank’s board and City Hall’s board were also hit. The town’s downtown development director told 92.1 WLHR that she took one image down and another popped up, so she turned the board off.
The company that sold the signs said it had removed the content, secured the affected systems and started an investigation. It would not speculate about the method until that work was finished. None of the reports say how the attackers got in. What the reports do establish is that the image reached the school’s sign through a system the school did not run.
Restaurants have seen this before. In April 2025, order counter and drive-thru displays at about 300 Mary Brown’s Chicken locations in Canada switched to a political message. invidis later learned that phishing gave the attackers access to several cloud IT systems and two on-premises signage platforms. As Sixteen:Nine reported, “the attackers managed to take over a user account on the customer’s on-premises installation.”
The routes differed, but each case leaves an operator with the same two questions. Who can change what your screens show, and how soon would you know if someone did?
Our post on the XCPE botnet covered the layer underneath, where a media player’s firmware can carry a backdoor. That problem calls for supplier checks and network containment. The incidents above sit higher up, in accounts and in the systems that hold them.
Why menu board security needs its own review
invidis makes the case that in quick-service restaurants, digital signage now does operational work. Menu boards, self-order kiosks and drive-thru systems manage pricing and product communication in real time.
A price on a menu board is the price a customer expects to pay. One account can push a change to every screen it is allowed to publish to.
So the review below works account by account. For each login that can touch your screens, you want four answers: whose it is, what it can publish, which screens it reaches and whether it still needs that access.
A six-part access check
1. Retire default and shared logins
Start with the accounts that do not belong to one person. Look for the admin login created at installation, a shared store manager account, an agency login from a past campaign and any password written into a handover document.
These accounts are the most likely to keep a default or widely known password. They are also the hardest to trace after an incident, because a change made from a shared login points to an account rather than a person.
Change every default password on the CMS and on anything else that can push content, such as a media player’s local admin page. Then replace shared accounts with named ones.
The US Cybersecurity and Infrastructure Security Agency issued a Secure by Design alert in December 2023 urging manufacturers to eliminate default passwords from their products. Until every product on your network does that, changing them is your job.
2. Give each person a sign-in, with a second step
With one login per person, you can remove someone without disturbing anyone else. Every recorded change then points to a name. In a franchise group, that includes the area managers and head-office marketing staff who publish into individual stores.
Turn on two-step verification wherever your CMS offers it. If your organization already uses an identity provider such as Microsoft Entra ID, Okta or Google Workspace, connecting the CMS through single sign-on (SSO) means people who sign in that way go through the provider’s own rules, including any two-step verification you require there.
Phishing gave the Mary Brown’s attackers their way in. A second step means a password on its own is no longer enough to open the account. invidis listed multi-factor authentication, SSO and IP restrictions among its recommendations for signage CMS platforms after that incident.
3. Separate preparing a change from publishing it
Most people who work with a menu board need far less access than an administrator. A shift manager may need to mark an item as sold out. A designer edits templates. Very few people need to change prices in every store, add screens or manage other users.
Roles let you write those limits into the system. For menu boards, the most useful split is between preparing a change and putting it live. When those permissions sit with different people, a price change needs a second person before it reaches customers, and one stolen login can do less.
The same Sixteen:Nine report recommended “detailed approval processes for content, user roles, and access rights.” Where your CMS can separate locations or clients into their own areas, use that too. A login for one store or one agency then cannot see or change another’s screens.
4. Close access when people leave
Add CMS accounts to the checklist that runs when someone leaves, changes role or moves to another store. Add them to the close of every agency or contractor engagement as well.
If the CMS is connected to your identity provider with automatic provisioning, often called SCIM, switching someone off in the provider can switch off their CMS account too. Without that link, someone has to remember.
A quarterly review of the user list catches what the checklist misses. Match each account to a current person and a current job, and remove the rest.
5. Put vendor access in the buying checklist
South Franklin Elementary did not run the system that put the image on its sign. Many screen networks rely on a supplier, integrator or agency with standing access to the CMS or the players. Before you sign, and at each renewal, ask them these questions.
- Which of your staff can publish to our screens, and how do they sign in?
- Do those accounts require a second sign-in step?
- How quickly will you tell us about a breach on your side?
- Can your access be limited to the screens and periods you need?
Write the answers into the contract or service description where you can. In Georgia, boards sold by the same vendor at a school, a bank and a city hall were hit the same morning, and the school traced its incident to a breach in the vendor’s system.
6. Notice unexpected changes before customers do
In both recent cases, people outside the organization noticed first. Customers spotted the prices in Germany, and parents spotted the image in Georgia.
Two habits shorten that delay. The first is looking at the screens. A remote view of what each screen is playing lets a manager compare the boards with the approved menu without walking the floor. A quick price check can also be part of opening the store.
The second is keeping a record of changes. If your CMS records who changed what and when, read that record after any surprise. It turns “the prices look wrong” into a specific account and a specific edit.
Decide in advance who can switch a screen to a known-good playlist or turn it off, and who locks the account that made the change. In Royston, a second image appeared after the first was removed. Taking content down buys time, but the account or system that published it still has to be shut.
Where Fugo fits
Fugo is a CMS, so it works at this access layer. Its Users, Roles & Spaces guide explains that every role is a set of permissions you switch on or off, and that editing playlists and publishing them are separate permissions. The built-in Content Creator role can create and edit content without publishing rights, and the Publisher role can push playlists live. Spaces keep screens, playlists and media fully separate, which the guide suggests for multi-location businesses and for agencies managing several clients.
On the Enterprise plan, Fugo supports SSO through SAML 2.0 or OpenID Connect, as the SSO overview describes. The same guide notes that there is no in-app setting yet to require SSO for every sign-in, so teams that need that should talk to Fugo support. SCIM provisioning through Okta or Entra ID is also on Enterprise and needs SSO set up first. With it, deactivating someone in the identity provider switches their Fugo account off and signs out their open sessions.
For checking what is on screen, the Screens overview shows how Grid view displays a live screenshot of what each screen is playing, along with its online or offline status.
If your menu boards already run on Fugo, open Settings, then Team, and work through the check above one account at a time.
Frequently asked questions
How did attackers change the German menu board prices?
invidis reported that they guessed a weak default password and got into the CMS. The reports did not name the restaurant chain, the CMS vendor or the hardware.
How was the Georgia school sign hacked?
School officials said the investigation found a breach in the external system of the company that operates the sign. The company said it would not speculate about the method until its investigation was complete.
What should a restaurant check first?
Remove default passwords and shared logins from anything that can publish to your screens. Then give each person their own account with a second sign-in step.
How can I tell if someone has changed my menu board?
Compare what the screens show with the approved menu, using a remote screen view if your CMS has one. Review any change record for edits nobody expected, and agree in advance who can pull content and lock an account.
Does single sign-on protect a digital signage CMS?
SSO moves sign-in to your identity provider, which can require two-step verification and switch off access centrally when someone leaves. Check whether your CMS still allows other ways to sign in alongside SSO, because those need their own controls.
The check on one page
Run this menu board security check account by account this week. Every account that can publish to a screen belongs to one named person. No default or shared passwords remain on anything that can change what customers see. Sign-in has a second step, ideally through your identity provider.
Preparing content and publishing it are separate permissions. People and agencies lose access when their work ends. Your vendors have told you who on their side can reach your screens. Someone checks the boards and knows how to pull content and lock an account.
