How do you stop a machine that suddenly begins spitting out cash — not because a bank teller made a mistake, but because a criminal has remotely ordered the ATM to “jackpot” itself? That is the urgent question federal investigators and bank security teams are asking after an FBI Flash alert reported roughly $20 million in losses from ATM jackpotting attacks in 2025, a surge that has thrust an old attack technique back into the spotlight.
The FBI’s Flash — a rapid, high-priority advisory used to warn the financial sector and allied agencies — said attackers exploited ATM systems and their supporting infrastructure to force machines to dispense all available cash, a technique known as “jackpotting.” According to the advisory summarized by industry reporting, the agency tied the wave of incidents to coordinated campaigns that combined malware, physical access to cash-handling hardware, and abuse of legacy maintenance interfaces that still exist in many ATM fleets.
Jackpotting is not new. First reported more than a decade ago, the attack’s profile has risen and fallen with the prevalence of vulnerable ATM models and the defenses deployed by banks and vendors. What has changed, the FBI and multiple industry analysts warn, is scale: attackers are automating parts of the operation, leveraging criminal infrastructure that supports cash-out operations, and targeting weaker links in supply chains or third‑party maintenance vendors.
For banks and payments firms, the practical picture is stark. An attack that forces dozens or hundreds of machines to empty simultaneously creates immediate cash losses, but also incurs investigation costs, branch closures, ATM replacement, insurance claims, and customer trust damage. The FBI’s estimate — about $20 million in losses in 2025 alone — is a headline figure that masks a broader set of downstream costs and operational disruptions.
Why this matters:
- Operational risk: Jackpotting can render retail channels unusable, forcing manual cash handling and diverting staff to containment and customer service.
- Supply‑chain exposure: Many attacks exploit third‑party maintenance interfaces, outdated firmware, or remote‑management tools long considered acceptable risk vectors.
- Regulatory and reputational fallout: Repeated incidents invite regulator scrutiny and heighten consumer concerns about the safety of cash withdrawals.
Technologists point to a handful of persistent problems. Legacy ATM operating systems, long product lifecycles, and patching challenges create a shelf of known vulnerabilities. “ATMs are often treated as appliances and get less security lifecycle attention than servers or endpoints,” said a senior security engineer at a payments technology firm who asked not to be named because of ongoing vendor engagements. Security teams also note that remote‑management protocols and vendor support accounts — if misconfigured or compromised — provide a ready path for attackers.
Policymakers and regulators face different but related dilemmas. Should there be prescriptive minimum security standards for ATM vendors and operators? Can regulators require vendors to support modern update mechanisms or multi‑factor authentication for maintenance interfaces? Some European and Asian jurisdictions have already tightened oversight of critical financial infrastructure; U.S. regulators may now consider similar, targeted guidance to reduce systemic exposure.
For individual users, the risk is less about personal account compromise and more about availability and perception. Customers may find fewer functioning ATMs in affected areas, and in extreme cases, localized cash shortages can disrupt small businesses and consumer routines. Banks must communicate clearly when incidents occur — balancing transparency with the need to avoid revealing remediation details that could help attackers.
Adversaries, including organized cybercriminal groups and physically enabled fraud rings, are viewing jackpotting through an economic lens: low technical barriers to entry on some targets, rapid monetization through cash-out networks, and the ability to blend physical and digital tactics. Law enforcement countermeasures — from takedowns to indictments — increase the risks for operators, but do not eliminate the underlying vulnerabilities that make jackpotting attractive.
Mitigation strategies are straightforward in principle but complex in practice. Practical steps recommended by industry specialists and echoed by law enforcement include:
- Rapidly inventory ATM fleets and identify models that run legacy operating systems or have known remote‑management weaknesses.
- Implement multi‑factor authentication and least‑privilege access for maintenance accounts; rotate and monitor vendor credentials.
- Harden network segmentation so ATMs and maintenance systems cannot be used as jump points into broader bank networks.
- Deploy endpoint protections and application allow‑listing on ATM OS images; establish tamper and anomaly detection for dispense commands.
- Work with vendors and peers to accelerate firmware updates and share indicators of compromise through industry ISACs and law enforcement channels.
There are tradeoffs. Upgrading ATM fleets is costly and slow; pushing vendors to redesign hardware and software takes time and market incentives. Smaller community banks and independent ATM deployers may lack the budgets for aggressive hardening, making a layered, collaborative approach — combining vendor support, insurer requirements, and regulatory incentives — more realistic.
The FBI’s flash serves as both warning and call to action: the techniques underpinning jackpotting remain effective where defenders have not closed basic operational gaps. For security teams, the advisory underscores the need to treat ATMs as part of the broader attack surface, not as isolated cash boxes. For policymakers, it raises the question of whether voluntary best practices will be enough, or if minimum standards should be mandated. For the public, it is a reminder that even familiar infrastructure can carry hidden digital risks.
If $20 million is the cost of this year’s wave, what will be the price of inaction next year? The answer will depend on how quickly banks, vendors, regulators, and law enforcement convert a warning into sustained, measurable defenses against an attack that, for now, remains both visible and preventable.
Source: https://www.infosecurity-magazine.com/news/jackpotting-surge-costs-banks-20m/
