Products are selected by our editors, we may earn commission from links on this page.
An ATM is supposed to be one of the safest places to access your money. But federal investigators say today’s biggest threat isn’t someone forcing open the machine—it’s someone convincing the machine to empty itself. In a recent Connecticut case, prosecutors allege a group of four men used malware and specialized hardware to make ATMs dispense cash on command, turning everyday cash machines into targets for high-tech theft.
Authorities say the group stole $529,220 from eight ATMs during a 10-day spree in August 2025, targeting machines at Interstate 95 service plazas and other locations across southern Connecticut. One stop in Fairfield alone allegedly yielded $136,000, making it the largest single haul in the operation. Four Venezuelan nationals have since been arrested and charged with interstate transportation of stolen property and conspiracy. They are presumed innocent unless proven guilty in court.
The alleged crimes have drawn attention not only because of the amount stolen, but because they showcase a form of cybercrime that attacks the technology inside ATMs rather than the cash stored in them.
How Investigators Say the “Jackpotting” Scheme Worked
According to court documents, the suspects followed a remarkably consistent pattern at each location. Prosecutors say one man opened the ATM cabinet and accessed its internal components, using specialized hardware and malware to compromise the machine before leaving the area. Once the system had been manipulated, the others allegedly approached the ATM one at a time to withdraw cash as though they were ordinary customers.
Investigators say the group sometimes spent hours at a single ATM, repeatedly withdrawing money while changing clothes between visits in an effort to avoid attracting attention. Surveillance footage and cellphone location data allegedly placed several of the suspects at the machines during the thefts, while photos recovered during the investigation reportedly showed large stacks of cash inside a vehicle and at another location.
The operation allegedly targeted at least nine ATMs between Aug. 8 and Aug. 18, 2025. One attempted theft failed after an ATM in Ansonia had received a software security update designed to block this type of attack, preventing any money from being taken.
A Growing Cyber Threat to Cash Machines
Although the Connecticut case grabbed headlines for its six-figure losses, officials say “jackpotting” has become an increasingly common tactic across the United States. Rather than stealing bank account information, criminals manipulate the ATM itself, overriding its software so it continuously dispenses the cash stored inside.
Federal data cited by investigators shows the problem has accelerated in recent years. The Department of Justice and FBI reported roughly 1,900 jackpotting incidents nationwide since 2020, with more than 700 occurring during 2025 alone. Those attacks resulted in more than $20 million being stolen, suggesting that organized groups are increasingly treating ATMs as cyber targets instead of physical ones.
Security experts have warned about jackpotting for years, but newer malware, improved coordination and organized criminal networks have made the attacks more sophisticated. Financial institutions have responded with software updates, stronger physical protections and enhanced monitoring designed to detect unusual activity before machines can be compromised.
The Investigation May Be Over, but the Challenge Isn’t
The FBI led the investigation with assistance from Connecticut State Police, Homeland Security Task Force partners, and law enforcement agencies in New York and North Carolina. Prosecutors allege the suspects traveled across multiple states while coordinating the thefts, making the investigation a multi-agency effort that stretched well beyond Connecticut.
Each defendant faces charges of interstate transportation of stolen property, which carries a maximum sentence of 10 years in prison, along with conspiracy, which carries a maximum penalty of five years. Federal officials emphasized that the criminal complaints contain allegations only and that the defendants remain presumed innocent unless proven guilty in court.
The case serves as a reminder that modern financial crime is evolving alongside the technology it targets. As ATMs become more sophisticated, so do the methods used to attack them—turning cybersecurity into one of the most important defenses protecting the cash people rely on every day.