Brian Krebs (noted and respected infosec analyst and blogger) reported this on 27th Jan.
First ‘Jackpotting’ Attacks Hit U.S. ATMs
ATM “jackpotting” — a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash on demand — has long been a threat for banks in Europe and Asia, yet these attacks somehow have eluded U.S. ATM operators. But all that changed this week after the U.S. Secret Service quietly began warning financial institutions that jackpotting attacks have now been spotted targeting cash machines here in the United States.
There is a lot more detail in his blog post on the subject and in the comments.
Then a few days later he also unearthed a report on the arrest on 20th November 2017 of three men suspected of conducting jackpotting attacks on US ATMs
The complaint says surveillance videos showed the men opening the top of the ATM, which housed the computer and hard drive for the ATM — but not the secured vault where the cash was stored. The video showed the subjects reaching into the ATM, and then closing it and exiting the vestibule. On the video, one of the subjects appears to be carrying an object consistent with the size and appearance of the hard drive from the ATM.
Approximately ten minutes later, the subjects returned and opened up the cash machine again. Then they closed the top of the ATM and appeared to wait while the ATM computer restarted. After that, both subjects could be seen on the video using their mobile phones. One of the subjects reportedly appeared to be holding a small wireless mini-computer keyboard.
Soon after, the ATM began spitting out cash, netting the thieves more than $24,000. When they they were done, the suspects allegedly retrieved their equipment from the ATM and left.
(quoting from Krebs' reporting on the subject).
The original report was from Wyoming's Oil City News
Reports from Teton County Law Enforcement say that four individuals were arrested during the early morning hours, after their van failed to traverse Teton Pass. Teton County Sheriffs saying that they contacted the vehicle just after 2:00 am, and were able to detect the odor of burnt marijuana during the contact.
Police further report that during a subsequent search of the van, they discovered misdemeanor amounts of raw marijuana and THC edible gummy candies, and several backpacks full of cash.
Law enforcement arrested the men on possession charges, however just before the men were released from jail, and after pleading guilty to the drug charges, the FBI notified the sheriff’s department about an ongoing investigation where the men were suspected to be stealing money from ATMs.
A fourth suspect, identified as Aslhy Javier Galeano Basurto, was arrested at the time in Teton County, however he was not listed among those who were booked into NCDC, on Monday.
Romeo and Echegaray face one charge each of Fraud and Related Activity in Connection With Computers and Bank Robbery and Incidental Crimes. The two mens charges stem from the theft of money from a Credit Union ATM in Parker, Colorado.
In court paperwork, Federal agents say that on October 10th, 2017 it was believed that two men accessed the computer workings and computer processor areas of the credit union’s Automated Teller Machine. It is further alleged that the men installed malicious software on the ATM, causing the machine to dispense cash without permission or authorization.
It is noted in the case that approximately $24,000 was missing from the ATM.
Eli Moreno Gonzalez faces charges of Bank Robbery, stemming from a November 12th incident reported in St. George, Utah. In that case court paperwork describes the complaint against Gonzalez being similar to that of Echegaray and Romero.
In the Utah incident, it is believed that an individual accessed the ATM and was able to install malicious software in the machine. After that surveillance video is reported to have captured several individuals with drawing money from the ATM without authorization. An audit of the machine would later show over $69,000 missing.