Secret Service: How hackers pose as ATM repairmen, steal cash

Hackers are draining ATMs of cash in a scheme known as 'jackpotting'. Secret Service agent Matthew O'Neill tells CNN Tech's Samuel Burke what we know so far about how the practice came to the U.S. and who may be behind it.

Posted: Jan 31, 2018 10:38 AM
Updated: Jan 31, 2018 10:38 AM

The Secret Service is warning banks about a hacking scheme called "jackpotting" that lets someone steal money from ATMs. It's the first time this type of scheme has made its way to the United States.

To execute the cyberattack, a thief needs physical access to an ATM and will use malware, physical hacking tools, or both, to take control of the machine and force it to dispense cash quickly. If it works, cash pours out of the ATM like the hacker won a jackpot.

"Criminals have been able to find vulnerabilities in financial institutions that operate ATMs, primarily ATMs that are stand-alone," the Secret Service said in a release shared with CNN Tech. "The targeted stand-alone ATMs are routinely located in pharmacies, big box retailers, and drive thru ATMs."

At least six attacks have taken place within the last week. They ranged in location from the Pacific Northwest to the Gulf region to New England. Thieves have stolen over $1 million in attacks so far.

The Secret Service said criminals associated with jackpotting can be individuals or organized crime groups.

ATM makers Diebold Nixdorf and NCR Corporation confirmed they have alerted clients to the potential jackpotting attacks. A spokesperson for Diebold Nixdorf said older Diebold units are being targeted.

Similar jackpotting attacks spread through Latin America last year.

Related: Two hours and 1,600 fake credit cards later: $13 million is gone

Jackpotting has also been reported in Europe and Asia. Independent security journalist Brian Krebs first reported the U.S. jackpotting threats.

In recent months, activity around ATM hacking and jackpotting has spiked on the dark web, according to Paulo Shakarian, CEO at threat intelligence firm CYR3CON. The dark web refers to networks of websites that require specific software to access. Some dark web sites are known for criminal activity.

Shakarian said his firm tracked an uptick in conversations around malware used for jackpotting and also noticed people talking on these forums about new ATM hacking hardware targeting specific machines. Shakarian also spotted a jackpotting guide available for sale on one dark web forum.

"Any one of those things by themselves might not lead you to believe that U.S. jackpotting is imminent," he said. "But now you're seeing multiple indicators that could be pointing to it."

The Secret Service did not say how many jackpotting cases the agency has seen. The release noted the agency received reports about planned U.S. jackpotting attacks through its Electronic Crimes Task Force partners.

-- CNN's Samuel Burke contributed to this report.

Indiana Coronavirus Cases

(Widget updates once daily at 8 p.m. ET)

Confirmed Cases: 33558

Reported Deaths: 2110
CountyConfirmedDeaths
Marion9616571
Lake3538185
Cass15897
Allen145168
St. Joseph124834
Elkhart116328
Hendricks116171
Hamilton115693
Johnson1093108
Madison58559
Porter51627
Bartholomew50034
Clark49241
LaPorte42423
Howard39526
Tippecanoe3903
Jackson3791
Delaware37736
Shelby36822
Hancock32728
Floyd31839
Boone30935
Morgan27824
Vanderburgh2652
Montgomery23517
White2318
Decatur22431
Clinton2231
Noble21121
Grant20621
Harrison19221
Dubois1923
Henry16910
Greene16824
Monroe16612
Warrick16628
Dearborn16621
Vigo1648
Lawrence15423
Miami1411
Putnam1367
Jennings1304
Orange12522
Scott1193
Kosciusko1111
Franklin1098
Ripley1086
Carroll922
Marshall901
Daviess8516
Steuben812
Newton7710
Wayne776
Fayette767
Wabash762
LaGrange712
Jasper651
Washington521
Jay500
Fulton481
Clay471
Rush462
Randolph463
Pulaski460
Jefferson431
Whitley393
Starke363
Sullivan341
Owen341
Brown331
DeKalb331
Perry310
Benton300
Knox290
Wells280
Huntington272
Tipton251
Crawford240
Blackford242
Fountain202
Switzerland200
Spencer191
Parke170
Posey160
Gibson142
Adams131
Ohio130
Warren121
Martin110
Vermillion100
Union80
Pike60
Unassigned0164

Illinois Coronavirus Cases

(Widget updates once daily at 7 p.m. CT)

Confirmed Cases: 117455

Reported Deaths: 5270
CountyConfirmedDeaths
Cook762663570
Lake8063287
DuPage7543362
Kane6188170
Will5442269
Winnebago215654
McHenry151471
St. Clair109179
Kankakee87144
Kendall76919
Rock Island64624
Champaign6177
Madison56558
Boone42817
DeKalb3924
Sangamon34629
Jackson26810
Randolph2674
McLean21713
Peoria2128
Ogle2023
Stephenson1992
Macon19519
Clinton18117
Union1519
LaSalle14713
Whiteside13512
Iroquois1314
Coles12514
Unassigned1250
Out of IL1191
Warren1130
Jefferson10116
Knox970
Grundy952
Monroe9411
McDonough878
Lee791
Cass710
Tazewell714
Henry680
Williamson642
Pulaski510
Marion500
Jasper457
Macoupin452
Adams441
Perry420
Montgomery391
Vermilion391
Morgan351
Christian334
Jo Daviess320
Livingston322
Douglas260
Menard210
Fayette203
Ford201
Jersey201
Woodford192
Mason180
Washington180
Mercer170
Hancock160
Shelby161
Bureau151
Carroll142
Bond121
Franklin120
Piatt120
Schuyler120
Clark110
Crawford110
Fulton110
Moultrie110
Brown100
Cumberland100
Logan100
Wayne91
Alexander80
Henderson80
Effingham71
Johnson70
Massac70
Saline70
Greene50
Marshall50
De Witt40
Lawrence40
Richland30
Stark30
Clay20
Edwards20
Gallatin20
Hamilton20
Wabash20
White20
Calhoun10
Edgar10
Hardin10
Pike10
Pope10
Putnam10
Terre Haute
Clear
56° wxIcon
Hi: 75° Lo: 53°
Feels Like: 56°
Robinson
Clear
56° wxIcon
Hi: 75° Lo: 53°
Feels Like: 56°
Indianapolis
Scattered Clouds
54° wxIcon
Hi: 73° Lo: 50°
Feels Like: 54°
Rockville
Broken Clouds
55° wxIcon
Hi: 74° Lo: 51°
Feels Like: 55°
Casey
Clear
52° wxIcon
Hi: 74° Lo: 53°
Feels Like: 52°
Brazil
Clear
56° wxIcon
Hi: 73° Lo: 51°
Feels Like: 56°
Marshall
Clear
56° wxIcon
Hi: 74° Lo: 52°
Feels Like: 56°
A wonderful Saturday with sunshine expected!
WTHI Planner
WTHI Temps
WTHI Radar

WTHI Events