Have ATMs across the US "spat out money" in the second half of January 2018?

Question

In a response to the DDoS attacks on several Dutch banks and other institutions, "cybersecurity specialist" Rian van Rijbroek claimed on 29 January 2018 on the Dutch news programme Nieuwsuur that banks in the USA had been hit with DDoS attacks, after which ATMs across the US had been targeted with an attack that made them spit out bills, which were then collected by money mules.

"We hebben nu recent, de afgelopen dagen... en dat is eh... informatie die ik eh... vandaag heb doorgekregen van een veiligheidsdienst... hebben we mee te maken gehad... en daar hebben we hetzelfde patroon gezien in de VS, dat ze dus ook deze testaanvallen hebben uitgevoerd en nu zijn... eh hebben diverse geldautomaten geld uitgespuugd op bepaalde tijdstippen en die zijn door geldezels... zijn dat... is dat geld opgehaald."

_{Nieuwsuur 29 January 2018 (in Dutch); interview starts around 17 minutes in, specific claim made at about 20 minutes.}

---

Translation

Recently, in the past few days — which is information I've gotten today from a security service — we've seen the same pattern in the US, first these [DDoS] attacks, after which ATMs started spitting out bills which were collected by money mules.

Rian van Rijbroek has received quite a bit of criticism for this interview. Her cybersecurity specialism seems to be largely self-proclaimed. A recent book she has co-written has been recalled amidst claims of both plagiarism and blatant nonsense.

Is this one of the latter? Or has there indeed been a recent spate of hacked ATMs spitting out money?
Specifically, first DDoS attacks on banks, then — presumably remotely — hacking the ATMs to make them spit out money.

Answer 1

Brian Krebs (noted and respected infosec analyst and blogger) reported this on 27th Jan.

27 Jan 18 First ‘Jackpotting’ Attacks Hit U.S. ATMs

ATM “jackpotting” — a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash on demand — has long been a threat for banks in Europe and Asia, yet these attacks somehow have eluded U.S. ATM operators. But all that changed this week after the U.S. Secret Service quietly began warning financial institutions that jackpotting attacks have now been spotted targeting cash machines here in the United States.

There is a lot more detail in his blog post on the subject and in the comments.

Then a few days later he also unearthed a report on the arrest on 20th November 2017 of three men suspected of conducting jackpotting attacks on US ATMs

The complaint says surveillance videos showed the men opening the top of the ATM, which housed the computer and hard drive for the ATM — but not the secured vault where the cash was stored. The video showed the subjects reaching into the ATM, and then closing it and exiting the vestibule. On the video, one of the subjects appears to be carrying an object consistent with the size and appearance of the hard drive from the ATM.

Approximately ten minutes later, the subjects returned and opened up the cash machine again. Then they closed the top of the ATM and appeared to wait while the ATM computer restarted. After that, both subjects could be seen on the video using their mobile phones. One of the subjects reportedly appeared to be holding a small wireless mini-computer keyboard.

Soon after, the ATM began spitting out cash, netting the thieves more than $24,000. When they they were done, the suspects allegedly retrieved their equipment from the ATM and left.

(quoting from Krebs' reporting on the subject).

The original report was from Wyoming's Oil City News

Reports from Teton County Law Enforcement say that four individuals were arrested during the early morning hours, after their van failed to traverse Teton Pass. Teton County Sheriffs saying that they contacted the vehicle just after 2:00 am, and were able to detect the odor of burnt marijuana during the contact.

Police further report that during a subsequent search of the van, they discovered misdemeanor amounts of raw marijuana and THC edible gummy candies, and several backpacks full of cash.

Law enforcement arrested the men on possession charges, however just before the men were released from jail, and after pleading guilty to the drug charges, the FBI notified the sheriff’s department about an ongoing investigation where the men were suspected to be stealing money from ATMs.

A fourth suspect, identified as Aslhy Javier Galeano Basurto, was arrested at the time in Teton County, however he was not listed among those who were booked into NCDC, on Monday.

Romeo and Echegaray face one charge each of Fraud and Related Activity in Connection With Computers and Bank Robbery and Incidental Crimes. The two mens charges stem from the theft of money from a Credit Union ATM in Parker, Colorado.

In court paperwork, Federal agents say that on October 10th, 2017 it was believed that two men accessed the computer workings and computer processor areas of the credit union’s Automated Teller Machine. It is further alleged that the men installed malicious software on the ATM, causing the machine to dispense cash without permission or authorization.

It is noted in the case that approximately $24,000 was missing from the ATM.

Eli Moreno Gonzalez faces charges of Bank Robbery, stemming from a November 12th incident reported in St. George, Utah. In that case court paperwork describes the complaint against Gonzalez being similar to that of Echegaray and Romero.

In the Utah incident, it is believed that an individual accessed the ATM and was able to install malicious software in the machine. After that surveillance video is reported to have captured several individuals with drawing money from the ATM without authorization. An audit of the machine would later show over $69,000 missing.