Blog: Protect your ATMs from Jackpotting

In a recent webinar, Diebold Nixdorf was joined by the US Secret Service (USSS) to provide an update on these kinds of attacks. According to the USSS, there are, on average, two alerts about jackpotting incidents every day. Similar reports are published by the Federal Bureau of Investigation (FBI), and a suspect related to jackpotting was added to the FBI´s Ten Most Wanted list. So, let’s have a look at what is going on.

The growing threat of jackpotting
As mentioned, jackpotting numbers in the United States are currently at an unprecedented level. From 2020-2025 over 1,900 attacks were reported with over USD 20 million lost in 2025 alone. During the webinar, we launched a poll asking which threats participants were most concerned about. With 84% of respondents, jackpotting was by far the most pressing concern. 

These incidents are not executed by tech-savvy individuals but are related to organized crime groups specializing in it over a longer period. Those organizations have resources for their own research and development and people they can deploy to be on-site. Unlike ATM burglary, jackpotting is not an opportunistic crime. It requires preparation and specialized tooling.

What is Jackpotting?
Generally, jackpotting is a category of cyberattacks with different variants. The most relevant incidents in the US are malware-based attacks utilizing the ATM computer and the already existing connection to the cash unit. The core element in these incidents is how the malware is installed on the ATM PC. There are different infection methods that evolve over time. If you would like a more detailed explanation I suggest taking a look at our fACT sheets: Each focuses on a single attack type and is written by our security experts. You can access them on our Global Security Portal. 

Jackpotting in the past and today
While infection methods also changed, a more important change occurred in how these incidents are organized. In the past, the on-site attacker with the necessary technical skills and tools was in full control of the attack. They created access to a USB port via drilling or melting through the fascia or opening it. Once they had that, they infected the ATM PC with malware and executed it. When these on-site attackers were apprehended, it had a strong impact on future attacks, as the actor with the skills and knowledge could be removed. 

In contrast, today the on-site attacker receives basic written instructions and additional support via phone. They are on-site to create the still-required physical connection, routing this to a remote attacker controlling all technical actions afterward. The on-site attacker does not have the same technical knowledge and access to the toolset as before. They would not be able to perform this attack on their own, while they still run the risk of being arrested. Through log files, the remote actor can track how much cash is dispensed, ensuring the on-site attacker doesn’t take more than their agreed share. 

This method concentrates on the technical know-how of just a few people who are harder to catch because they stay out of the direct line of fire. Consequently, arresting the actors with actual knowledge has become harder. If you’d like to learn more, consider downloading our Cybersecurity Threat Report. 

How to protect against jackpotting attacks
There are several countermeasures that should be put in place to protect against jackpotting attacks. As with many attack scenarios, a layered approach with a combination of logical protections on different software layers and robust monitoring is the way to go.

Diebold Nixdorf offers a wide range of security solutions for ATMs. Among others, our Vynamic® Security portfolio offers strong protection against cyber incidents, especially malware-based attacks like jackpotting. 

ATM security can be a complex topic due to the various attack vectors but a multi-layered approach to security is always the best strategy to protect your ATM fleet. To take a more detailed look at your own fleet and risk, we can do an individual security assessment with you and build a security strategy for your fleet together. Request your session now.