Jackpotting, a new technique for hacking ATMs

An international network targeting ATMs has been dismantled in France. Rémy Heitz, the Paris public prosecutor, recently announced that two men had been indicted and subsequently imprisoned in Paris. These 2.0 robberies have been multiplying since the start of the lockdown.

What is jackpotting?

Jackpotting first appeared in the USA in 2012 when, at a public conference in Las Vegas, a hacker from New Zealand named Barnaby Jack demonstrated that it was possible to hack into the software of ATMs. To reach this conclusion, the man worked for 2 years on two ATMs purchased for $2,000 each.

This technique can be used in two different ways. The "physical" approach involves drilling a hole in the front of the ATM, then connecting the computer to the machine via a cable. The dispenser module is generally controlled by a conventional operating system, and can be hacked using simple software. The "logical" approach involves hacking the ATM control module remotely. In both cases, criminals avoid being too greedy, as emptying the ATM completely triggers an alarm. This requires an estimate of the number of banknotes available, based on prior surveillance.

The number of "cyberbrakes" soars

In Europe, jackpotting quadrupled between 2015 and 2016. Indeed, their number rose from 15 to 58. In 2018, a spectacular attack targeted a hundred banks worldwide simultaneously. It enabled criminals to steal almost a billion euros.

Confinement has not made life any easier for the criminals. Several attacks on ATMs were recently recorded in Rennes and the Nice region, enabling the perpetrators to extort almost 280,000 euros. The raids were carried out discreetly, without any weapons or ram cars, but with the help of accomplices mainly based in Eastern Europe. The individuals arrested are suspected of belonging to an international network that enabled hackers to take control of ATMs remotely. The arrests were made in connection with a judicial investigation opened on March 16, notably for "participation in a criminal conspiracy", "organized theft" and possession of equipment designed to undermine the operation of an automated processing system.

Jackpotting" continues to grow in France. According to the Paris public prosecutor's office, this case highlights the need to "think in terms of integrated systems, focusing on the long term, the specialization of players and the complementarity of expertise".