In less than an hour, cyberthieves managed to steal a cool $9 million from ATM machines around the world last November using cloned payroll debit cards issued by payment processor RBS Worldpay.
While known about beforehand – RBS Worldpay admitted last month that unknown intruders stole information on roughly 100 different debit cards through its computer network – the scope and scale of this attack was not completely clear until Tuesday, after an investigation from New York TV broadcaster WNYW Fox 5 News revealed that said hackers managed to lift the debit cards’ withdrawal limits.
An FBI official told WNYW that a number of unidentified “cashers” – low-level pawns in the overall scheme – hit 130 different ATMs around the world within a 30-minute period, withdrawing roughly $9 million.
The rapid-fire transactions came from 49 different cities, including New York, Montreal, Moscow, and Hong Kong.
Normally, the cyberthieves’ efforts would have been hampered by ATM withdrawal limits, but it appears that someone removed the stolen cards’ limits beforehand – allowing thieves to drain the entire balance in one transaction.
Currently the FBI says it has no leads on suspects’ identities, with the exception of security camera footage (PDF).
“We've seen similar attempts to defraud a bank through ATM machines but not anywhere near the scale we have here,” said FBI Agent Ross Rice. “We've never seen one this well coordinated.”
A class-action lawsuit was filed against RBS Worldpay, reports Wired’s Threat Level, by an undisclosed party.
Earlier this year fellow payment processor Heartland Payment Systems admitted that cyberthieves installed sniffers on its internal network, allowing hackers to compromise up to 100 million credit card accounts.
Last year, similar scams befell payment card company iWire, as well as account-holders at Citibank, notes Wired. Thieves withdrew $5 million from iWire payment cards in about four days’ time, while Citibank customers lost nearly $2 million thanks to a compromised server that handled Citibank’s 7-Eleven ATM network.