Malicious ATM intrusions, such as the late-winter breach that resulted in the compromise of Citibank debit card data, are not at all surprising given the vulnerable state of many of the servers and other components involved in processing such transactions, according to some industry representatives.
In fact, such incidents happen more often than generally perceived, though very few of them get the same kind of public attention that the Citibank breach attracted.
In the case of the Citibank attack, a server that processes withdrawals for Citibank-branded ATMs located at 7-11 convenience stores in the New York City area was breached sometime earlier this year. Card data and PIN codes stolen from that server were used to make hundreds of fraudulent ATM withdrawals during February, resulting in losses of at least US$750,000 to the bank.
ATM video cameras caught images of a man in a tan jacket and Top Gun hat making the fraudulent withdrawals. The footage led authorities to a man named Yuriy Ryabanin, who was later arrested in connection with the intrusions and fraud. Arrested along with him in connection with the incident were two other individuals, Olena Rakushchynets and Ivan Biltse.
Citibank confirmed that the intrusions caused it to block and reissue cards to an undisclosed number of customers. But in a formal statement, the company said it did not own or operate any of the servers that were compromised in the incident. All Citibank-branded ATMs in 7-11 stores are owned and operated by Cardtronics, a US-based operator of ATMs that manages close to about 36,000 machines, a spokesman added.
A Cardtronics spokesman refused to comment on the intrusions, saying that the company was not involved in any of the criminal proceedings currently underway in the case. The spokesman added that, at the moment, investigations into how the breach might have occurred are still underway and that it is still not clear if any server owned by Cardtronics was in fact compromised. The spokesman also refused to offer any reasons as to why only Citibank customers appear to have been affected by the intrusion.
Most of the public details relating to the incident come from court papers filed in connection with Ryabinin's arrest. They show that Citibank informed the FBI about the ATM server breach around Feb 1 of this year. The document doesn't mention how many debit card accounts might have been compromised in the hack, but do show that Ryabanin made hundreds of illegal withdrawals over a period of a few days during the end of February using information stolen in the heist. At the time of his arrest for the Citibank intrusion Rybanin was already being investigated by federal authorities for a similar fraud he had perpetrated against First Bank.
In that incident, Ryabanin breached four bank accounts used by employers to fund pre-paid cards that they were using to pay salaries to employees who lacked bank accounts. The October 2007 compromise resulted in thousands of fraudulent ATM withdrawals being made around the world, eventually costing First Bank about US$5 million in losses according to the court papers.