FBI Reports More Than 700 ATM Jackpotting Incidents in 2025
Summary
The FBI reported more than 700 ATM jackpotting incidents in 2025, involving over $20 million in losses. The article describes Ploutus malware’s use to control ATMs and cites a DOJ indictment alleging at least $5.4 million in thefts.
Key points
- The FBI said it tracked more than 1,900 ATM jackpotting incidents since 2020, including over 700 in 2025 with more than $20 million in losses.
- The FBI described Ploutus malware as bypassing XFS authorization workflows to instruct ATMs to dispense cash.
- According to the FBI, attackers often use generic keys to access ATMs and install malware by copying it to or replacing a hard drive or external device.
- The article says the malware can interact directly with ATM hardware and be adapted across manufacturers.
- A DOJ indictment alleges a group used Ploutus against credit union ATMs between February 2024 and December 2025, stealing at least $5.4 million from at least 63 machines.
Article Details
- Event Type
- ATM jackpotting incidents involving Ploutus malware and physical access to ATM hardware.
- Impact
- The FBI reported more than 1,900 incidents since 2020 and over 700 in 2025, with losses exceeding $20 million in 2025. A separate ring was indicted in connection with at least $5.4 million stolen from at least 63 credit-union ATMs between February 2024 and December 2025. The malware can bypass bank authorization and cause ATMs to dispense cash.
Malware
Vendors
Products
Kalignite PlatformPloutus has been used to target a variety of ATM vendors, including Diebold Nixdorf, Kalignite Platform and others.Microsoft WindowsThe malware interacts directly with ATM hardware and can be adapted across different manufacturers by exploiting Windows.XFSThe Ploutus family of malware lets attackers bypass XFS and directly control ATMs—often after gaining physical access with generic keys—enabling rapid, hard-to-detect cash withdrawals across multiple vendors.
Countries
MexicoIt was initially deployed against ATMs across Mexico in 2013, allowing criminals to empty machines by either attaching an external keyboard attached to the ATM or by sending an SMS message, a technique that had neverUnited StatesDiebold Nixdorf issued multiple alerts in 2017 and 2018 about variants of the malware being used to steal money from ATMs across Mexico and the U.S.