What is ATM jackpotting? How malware helped thieves steal $529,000 from cash machines

A sophisticated cyber-enabled ATM theft operation that allegedly stole more than $529,000 from cash machines across Connecticut has led to the arrest of four men accused of carrying out a series of "ATM jackpotting" attacks, according to U.S. federal prosecutors. The suspects now face multiple federal charges that could result in lengthy prison sentences if convicted.

The alleged thefts took place over a 10-day period in August 2025, when the group targeted at least nine ATMs located at Interstate 95 rest stops and other locations across the state, according to the U.S. Attorney's Office for the District of Connecticut.

READ THIS: Beijing tower crash: Pilot suffered anxiety, wrote about suicide in diary, probe finds

What is ATM jackpoting

Authorities allege the suspects used specialised hardware and malware to manipulate the machines into dispensing large amounts of cash without authorisation, a technique commonly known as "ATM jackpotting." In one incident alone, prosecutors say the group extracted $136,000 from a single ATM at a Fairfield rest stop. Overall, investigators estimate they stole $529,220 from eight machines.

Identified accused

The four accused have been identified as Euclides Moreno Itanare (28), Willian Ricardo Flores (49), Alberto Jose Freites Arvilla (41), and Luis Jose Freites Arvilla (38). According to prosecutors, surveillance footage revealed a consistent pattern in their operations.

"For each of the thefts, the pattern of behaviour was similar," the U.S. Attorney's Office said in its criminal complaint.

Prosecutors alleged that Luis Jose Freites Arvilla acted as a lookout, while Alberto Jose Freites Arvilla accessed the ATM's internal components before the remaining suspects took turns withdrawing cash. Investigators also said the group changed clothes between withdrawals in an attempt to avoid detection.

ALSO READ: America turns 250—and Indian-origin CEOs are powering its biggest companies

Involvement of the FBI

The investigation, led by the FBI along with Connecticut State Police and local law enforcement agencies, eventually linked the suspects to the crimes using surveillance footage, cellphone location data, digital evidence and photographs allegedly recovered from their online accounts. Authorities said some of the evidence included images showing large amounts of cash and internet searches related to ATM repair and skimming methods.

The suspects were arrested on June 25 and have been charged with interstate transportation of stolen property and conspiracy. If convicted, they face prison terms of up to 10 years for the transportation charge and five years for conspiracy.
Federal officials say the case highlights the growing threat posed by ATM jackpotting attacks, in which criminals use malware to bypass a machine's security systems and force it to release cash.