What Happened
Criminals forced more than 700 ATMs across the United States to dispense cash on command last year, netting approximately $12 million. The attack method, called jackpotting, isn't sophisticated. Attackers opened ATM cabinets using generic keys, often available online, then either injected malware via USB drive or swapped the hard drive entirely. Once the malware was installed, they commanded the machine to dispense all its cash.
The Federal Bureau of Investigation issued a warning about the resurgence, but the technique itself dates back more than two decades. The problem isn't the attack vector. It's that many institutions still haven't closed the gaps that made jackpotting possible in the first place.
Timeline
Early 2000s: IBM retired OS/2, the operating system running most ATMs worldwide. Manufacturers migrated to Windows-based systems.
2000s, 2010s: Attackers exploited Windows vulnerabilities through network attacks and physical USB-based malware installation. Jackpotting became a known threat.
2020s: After a period of lower activity, jackpotting incidents surged. The FBI reported more than 700 cases in the prior year.
The gap between the initial OS migration and today's resurgence spans two decades. This isn't a timeline problem; it's a control maintenance problem.
Which Controls Failed or Were Missing
Physical Access Controls
Attackers used generic cabinet keys to open ATM enclosures. This is a failure in physical security at the device level. If your ATM cabinets can be opened with keys available on secondary markets, you don't have physical access control.
Endpoint Hardening
The malware ran on Windows-based ATMs without detection. This indicates missing or outdated endpoint protection, unsigned code execution, and likely no application allowlisting. If an ATM accepts and runs code from a USB drive inserted by someone who isn't an authorized technician, your endpoint security posture is non-existent.
Network Segmentation
Jackpotting malware often communicates with external command-and-control infrastructure or spreads laterally. ATMs sitting on flat networks without segmentation create exposure not just for the device itself but for connected systems. If your ATMs can reach anything beyond their transaction authorization endpoints, you've given attackers a foothold.
Patch Management
Windows vulnerabilities have been well-documented for decades. The fact that ATMs remain exploitable through known OS vulnerabilities points to absent or inconsistent patch cycles. If you're not patching ATMs on a defined schedule, you're choosing operational convenience over security.
Monitoring and Alerting
In most jackpotting cases, the first indication of compromise is when the ATM is empty. That means you had no visibility into unauthorized cabinet access, no alerting on unusual cash dispense patterns, and no detection of malware execution. If you can't see an attacker opening your ATM cabinet and forcing it to dispense $20,000 in ten minutes, your monitoring isn't working.
What the Relevant Standards Require
PCI DSS 4.0
While ATMs fall into a specialized category, many requirements apply directly:
Requirement 2.2.7: System configurations must be hardened to prevent misuse. This includes disabling unnecessary services, removing default accounts, and implementing application allowlisting. An ATM that executes unsigned code from a USB drive fails this requirement.
Requirement 5.2.3: Anti-malware mechanisms must be actively running and cannot be disabled by users. If your ATM accepts malware installation without detection, you don't meet this control.
Requirement 6.4.3: All security patches must be installed within one month of release for systems exposed to untrusted networks. Your ATMs connect to transaction networks. They require patching.
Requirement 8.3.6: Multi-Factor Authentication is required for all access into the Cardholder Data Environment. If your technicians can access ATM administrative functions with only a physical key, you're not meeting this requirement.
Requirement 11.5.1: Deploy change-detection mechanisms to alert on unauthorized modifications to critical files and systems. An attacker swapping hard drives should trigger immediate alerts.
NIST SP 800-53 (for regulated financial institutions)
AC-3 (Access Enforcement): Systems must enforce approved authorizations for access. Generic keys and unsigned code execution violate this control.
SI-3 (Malicious Code Protection): Organizations must employ malicious code protection mechanisms at system entry and exit points. USB ports on ATMs are entry points.
CM-3 (Configuration Change Control): Changes to systems must be controlled and monitored. Hard drive swaps are configuration changes.
Lessons and Action Items for Your Team
Replace Generic Cabinet Keys
If your ATMs use manufacturer-default keys, you're relying on security through obscurity. Work with your ATM vendor to implement unique keying or, better, electronic locks with access logging and alerting. You should know who opened which cabinet and when.
Implement USB Port Controls
Disable USB ports entirely if they're not required for maintenance. If they are required, implement port control software that only allows signed, authorized devices. Log every USB connection attempt.
Deploy Endpoint Detection and Response
Your ATMs are endpoints. Treat them as such. Deploy EDR agents that can detect malware execution, unsigned code, and unusual process behavior. If you can't deploy full EDR due to ATM OS limitations, implement application allowlisting at minimum.
Segment ATM Networks
Place ATMs in isolated VLANs with strict firewall rules. They should only be able to communicate with transaction authorization systems and your monitoring infrastructure. Nothing else. Test your segmentation. If an ATM can reach your core banking systems or the internet directly, you haven't segmented anything.
Establish Patch Management Cycles
Define maintenance windows and patch your ATMs monthly. If uptime requirements prevent monthly patching, you need redundancy, not excuses. Virtual patching through network controls can provide interim protection, but it's not a substitute for applying patches.
Monitor Cash Dispense Patterns
Implement real-time alerting for unusual dispense activity: multiple large withdrawals in rapid succession, dispenses without corresponding authorization messages, or cabinet access followed immediately by cash dispense. These patterns should trigger immediate investigation.
Require MFA for Administrative Access
Technicians performing ATM maintenance should authenticate with more than a physical key. Implement MFA for any administrative console access. Log every session.
Conduct Regular Tamper Inspections
Physical inspections should occur on a defined schedule. Look for evidence of cabinet tampering, unauthorized hardware, or signs of forced entry. If you're only inspecting ATMs when they run out of cash, you're inspecting too late.
The 700 jackpotting cases reported last year didn't happen because attackers developed new capabilities. They happened because institutions left two-decade-old vulnerabilities unaddressed. You can't prevent every attack, but you can close the gaps that make your ATMs easy targets.
