As reported by SecurityAffairs, five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny after failed ATM jackpotting attempts in Kansas — part of an FBI-tracked wave of 700+ incidents causing $20 million in losses during 2025. While this particular crew failed at both target sites, the scale of the problem demands attention from every organization operating or servicing ATMs.
Why This Case Matters Beyond Kansas
ATM jackpotting occupies a niche but critical intersection of physical access and malware deployment. Unlike card skimming or credential theft, jackpotting attacks the ATM itself — criminals gain physical access to the machine's internals, install malware (often variants of Ploutus or malware tailored to specific ATM vendors), and then remotely trigger the cash dispenser to empty the cassettes.
The Kansas case is instructive precisely because it failed. The attackers triggered an alarm in Wamego and couldn't get the Manhattan ATM to dispense. This tells us that basic physical security controls and ATM-side anomaly detection still work — when they're properly configured and monitored. The $20M in losses elsewhere suggests many operators haven't implemented these baselines.
Who Is Most at Risk
The Broader Threat Landscape
The FBI's 700+ incident count for 2025 represents a significant escalation. This is organized, repeatable crime — not opportunistic.
Jackpotting crews operate with logistics: they travel between states, carry malware on USB drives or diagnostic laptops, and often coordinate with lookouts. The Kansas group traveled from Indiana, mirroring patterns seen in multistate ATM crime rings. Law enforcement is responding, but the arrest-to-deterrence ratio hasn't kept pace with the attack volume.
Shield53 Recommendations
Immediate Actions
- Audit physical access controls: Verify that all ATMs — especially off-premise units — have operational alarm sensors on upper cabinet doors and secure locks. Test that alarms route to a monitored response center.
- Patch ATM software: Ensure all machines run vendor-supported OS versions with the latest security patches. Disable unused USB ports and external interfaces unless required for servicing.
- Implement vendor verification: Require service technicians to provide pre-scheduled work orders verified against a known dispatch system. Train on-site staff at retail/host locations to challenge anyone accessing ATM internals.
- Deploy host-based intrusion detection: Install endpoint monitoring on ATM systems that flags unauthorized process execution, USB device insertion, and abnormal dispenser commands.
- Review surveillance coverage: Confirm cameras capture both the ATM front and the service access panel. The Kansas case was solved partly through surveillance footage — ensure your recordings are retained for at least 90 days.
Strategic Hardening
- Coordinate with ATM manufacturers on firmware-level controls that validate signed code before dispenser activation.
- Join FS-ISAC to receive timely intelligence on jackpotting campaigns and emerging malware variants.
- Conduct annual red team exercises simulating physical access + malware installation to validate your detection stack.
ATM jackpotting isn't a new threat, but the 2025 loss figures indicate it's accelerating. The organizations that treat ATMs as part of their cybersecurity attack surface — not just a physical security concern — will be the ones that avoid becoming the next statistic.
