Spitting Cash: ATM Jackpotting Attacks Surged in 2025

In 2025 ATM "jackpotting" attacks surged — the FBI recorded about 700 machines compromised last year and roughly 1,900 incidents since 2020, with losses above $20M. Attackers used malware such as Ploutus and physical tampering (replacing or infecting ATM hard drives, exploiting XFS, or compromising management systems) to trigger cash payouts in minutes; US authorities have charged dozens of suspects including individuals linked to the Tren de Aragua group. The advisory and industry guidance emphasize stronger physical security, TPM-backed secure boot, firmware integrity, application whitelisting, MFA for remote access, and tamper detection to mitigate the threat.