Dozens of European ATMs rooted, allowing criminals to easily cash out
Criminals with physical access to ATMs install malware to control flow of money. — Criminals are installing fairly sophisticated malicious programs on banks' ATMs, allowing them to control access to the machines …
Context & Ripple Effects
This is the second wave of a physical-access ATM attack pattern that surfaced with the cash machines raided via infected USB sticks reported at the end of 2013. What has changed is scale and sophistication: rather than isolated machines, criminals are now installing fairly advanced malware on dozens of European ATMs, giving them direct control over how money flows out.
The pickup across Securelist, Threatpost, SecurityWeek, ZDNet, CIO.com and other security outlets signals that the banking industry treats this as more than a curiosity — the cash machine is being reclassified as an endpoint that can be fully compromised, not just skimmed.
First-order effects
- Banks operating the affected machines face direct losses through fraudulent cash-outs and must audit and rebuild any ATM where an attacker had physical access, since disk-level compromise defeats network-side fraud controls.
Second-order effects
- ATM vendors and bank security teams are pushed toward defenses that assume physical tampering — hard-drive encryption, software whitelisting, and enclosure sensors — shifting spending from transaction monitoring to device integrity.
Third-order effects
- If the pattern holds, cash networks converge on the same lifecycle discipline as any other connected fleet: remote integrity verification and rapid reimaging become baseline requirements, because a single unattended kiosk can no longer be trusted.
The trend: ATM crime is moving from skimming card data toward full software takeover of the machine itself, forcing banks to treat cash dispensers as manageable endpoints.