How $12.78 million was stolen from 1,400 ATMs in less than three hours

Often in the news, there are reports of a data breach or a company’s customer data center being hacked, but rare are the instances where it’s found out how just how exactly all that information is being used. Recently, though, we saw the completion of a hack-to-use cycle, and now investigators are trying to connect the dots.

On May 15, $12.7 million was fraudulently withdrawn from 1,400 cash machines across Japan in just under three hours’ time.  

The withdrawals were made with credit cards that were created using data stolen from Standard Bank, a South African bank.

The Bank estimates its total losses to be just under $20 million.

An initial investigation into the operation suggests 100 people were involved in withdrawing money. All machines used were 7-11 cash machines which, unlike most other machines in Japan, accept foreign cards.

The maximum amount a user can withdraw from these machines is $913; this was the exact amount taken out of each machine in each of the 14,000 transactions that took place. 

Representatives from Standard Bank described the event as a “sophisticated, coordinated fraud incident”, adding that it was accomplished using just a “small number” of fake cards from account data belonging to it. 

The Bank made it a point to say that no customers suffered personal financial losses as a result of the heist. 

Japanese police are now reviewing security camera footage in hopes of identifying suspects. Both Japan and South Africa are also working with Interpol to figure out how the data was stolen, and the operation coordinated.

No suspects have been identified as of the date this article was published.

Via BBC