Hackers able to make ATMs spit cash like winning slot machines are now operating inside the United States, marking the arrival of “jackpotting” attacks after widespread heists in Europe and Asia, according to security news website Krebs on Security.
Thieves have used skimming devices on ATM machines to steal debit card information, but “jackpotting” augurs more sophisticated technological challenges that American financial firms will face in coming years.
“This is the first instance of jackpotting in the United States,” said digital security reporter Brian Krebs, “It’s safe to assume that these are here to stay at this point.”
On his website, Krebs reported Saturday that the Secret Service has warned financial institutions about “jackpotting” attacks in the past few days, though specifics have not been revealed. Hackers have also been reported to remotely infect ATMs or completely swap out their hard drives.
Whichever method is used, the results are about the same. At a hacker conference a researcher brought two infected ATMs to the stage and gave a demonstration.
In the first example, a volunteer from the audience swiped a card through the ATM, and the researcher instantly brought up his credit card number and personal information on a computer spreadsheet.
In the second, the researcher gave the machine a command. “Jackpot!!” flashed on the ATM’s screen, and it began spitting bills onto the floor as the crowd cheered.
Small-scale jackpotting attacks were reported sporadically in many countries over the next few years. They finally went big time in 2016.
A gang stole $13 million from Japanese ATMs in three hours. In the summer, loose cash was spotted fluttering around dozens of First Commercial Bank ATMs.
First Commercial subsequently froze withdrawals at more than 1,000 ATMs. A police investigation revealed masked thieves had been waiting in front of the hacked machines and carried cash away by the bag load — more than $2 million across the country.
