On August 10, the FBI delivered a confidential memo to certain
banks, warning of an imminent and sophisticated hacking plot using
compromised ATM systems. Over the next few days, hackers breached
an ATM network operated by a bank in India and siphoned off $11.5
million through 14,849 fraudulent ATM withdrawals in 28 countries
in about 2 hours and $2 million in fraudulent bank transfers to
China. This wasn't the first attack of this type on a financial
institution and it will certainly not be the last.
With the scale, speed, and international scope of such an
attack, we all might want to say, "Toto, I've a feeling
we're not in Kansas anymore."
This type of attack is known as an "ATM cash-out"
scheme or "unlimited operation" where hackers use malware
to breach bank software and access customer card information. Once
inside the organization, hackers can delete fraud controls, such as
limits on daily withdrawal amounts. The hackers can then remotely
instruct ATMs to
