Hackers stole $2 million from ATMs using ‘just their smartphones’

Earlier this month, thieves remotely hacked 34 ATMs belonging to the Taiwanese First Commercial Bank, causing infected machines to spew more than $2 million dollars in cash. The attack was commenced entirely through computer software, without the use of fraudulent credit cards.

Surveillance footage showed two men wearing face masks and hats stuffing heaps of cash into backpacks throughout the city of Taipei. The Duo successfully cleared all 34 ATMs across 20 branches within a short span of five to 10 minutes, forcing the bank to freeze withdrawals from nearly 1,000 other ATMs of the kind targeted in the heist, furthering its loss.

Authorities have not yet deciphered how the hackers managed to bypass the ATM's stringent security code, but Taiwanese police have confirmed that malicious code was involved, claiming that a self-destructing software was remotely uploaded onto the ATMs from a mobile device, potentially a smartphone. All evidence of contamination disappeared once the ATM completed its cash dispensation. Wincor Nixdorf, the German manufacturer of the ATM, has dispatched investigators to Taiwan in hopes of learning what happened.

 “It is still not clear how the suspects stole such a large amount of money from the ATMs,” a Taiwanese official told Agence France-Presse. “My understanding is this is the first time such a criminal method has been discovered here.” Investigators have so far learned that three different malware were used to trigger the withdrawal.

Further developments revealed that the duo was part of a larger, 16-member international gang. One of the two withdrawers, a Latvian, was arrested while eating in a restaurant in Yilan, a city located in the North Eastern section of China. The other suspect, as well as a third, were from Romanian. They were arrested in Taipei after police found more than T$50 million of the stolen money in a hotel room. The remaining 13 suspects have felt Taiwan.

ATM hacks are becoming increasingly sophisticated, suggesting that criminal measures are evolving beyond mere card skimmers. On May 15, a coordinated assault on all of Japan saw $12.7 emptied from 1,400 ATM in under three hours.

Source: Fortune