Federal prosecutors say a sophisticated “ATM jackpotting” crew quietly drained more than $400,000 from Upstate New York cash machines in just one week.
All six men now under indictment are Venezuelan nationals, according to the U.S. Attorney’s Office for the Northern District of New York.
In a press release out of Syracuse, U.S. Attorney Carla B. Freedman announced that Joelvis Jose Rivas-Solorzano, Silvio Fabian-Ordonez, Jose Medina, Jose Navarro, Deivy Santiago Pena-Rojas, and Jefferson Jose Marquez-Marquez have been charged in connection with what she calls a nationwide ATM jackpotting conspiracy.
Reporter Anne Hayes of Syracuse.com adds that prosecutors believe the group hit multiple banks and credit unions across Upstate New York, including Syracuse, Binghamton, and Norwich.
What Prosecutors Say Happened
According to the U.S. Attorney’s Office, all six men are charged with conspiracy to commit bank larceny and multiple counts of bank larceny tied to the alleged scheme.
Federal prosecutors say they are tied to a broader nationwide operation that exploits both physical and software weaknesses in ATM machines.
Hayes reports that the indictment accuses the men of using a device to infect ATMs with malware.
Once the malware took control, the machines allegedly began spitting out cash in large amounts – not tied to any customer account.
In December 2023, several financial institutions in the Northern District of New York became victims, the U.S. Attorney’s Office says.
In total, more than $400,000 was stolen during four separate “jackpotting” events in Onondaga, Broome, and Chenango counties.
It’s the kind of crime that feels like something out of a heist movie.
But for the local credit unions and their members, it was very real money walking out the door.
How “ATM Jackpotting” Works
The U.S. Attorney’s Office describes “ATM jackpotting” as a method where criminals exploit physical and software vulnerabilities in ATM machines so they dispense cash to unauthorized users.
Typically, one or two people use a key or other means to open the machine, gaining access to the inside.
Once inside, prosecutors say, a foreign device is installed.
That device allows a hacker to take control of the ATM’s software.
After that, Hayes notes, groups of “cash-out” runners can show up and run transactions while the machine dumps its cash reserves.
Crucially, the withdrawals are untethered from any actual bank account – the money comes straight from the ATM’s internal store, not from a victim’s card.
From the bank’s perspective, it looks like the machine just suddenly emptied itself.
The loss hits the institution, not a specific customer.
This is part of what makes jackpotting so attractive to organized groups.
It’s high-dollar, low-friction, and if done quickly, they can be gone long before anyone realizes the ATM has been compromised.
Four Days, Four Machines, $418,400 Gone
Anne Hayes lays out a tight, almost surgical timeline in her Syracuse.com report.
According to the indictment she cites, the crew allegedly targeted four ATM locations between December 10 and December 16, 2023.
On December 10 and 11, prosecutors say the group went after Empower Federal Credit Union ATMs in Syracuse.
From those two hits alone, Hayes reports, they allegedly withdrew $134,000 and $150,000.
On December 15, the indictment says the crew moved to a GHS Federal Credit Union ATM in Binghamton and took another $48,000.
Then, on December 16, they allegedly struck a GHS Federal Credit Union ATM in Norwich and removed approximately $86,400.
Add those numbers together and you get more than $418,000 in just four days of actual cash-out activity.
The U.S. Attorney’s Office rounds that to “over $400,000” in its press release.
For relatively small, regional credit unions, that kind of hit is serious.
Even if insurance or loss reserves eventually cover much of it, there’s still disruption, investigation costs, and shaken confidence from customers who suddenly realize their “local” ATM can be turned into a slot machine by foreign malware.
Who The Defendants Are And What They Face
Both the U.S. Attorney’s Office and Hayes note that all six defendants are citizens of Venezuela.
They are identified as Joelvis Jose Rivas-Solorzano, Silvio Fabian-Ordonez, Jose Medina, Jose Navarro, Deivy Santiago Pena-Rojas, and Jefferson Jose Marquez-Marquez.
According to the federal press release, Rivas-Solorzano, Fabian-Ordonez, Medina, Navarro, and Pena-Rojas have all been arrested and are currently in custody in the Northern District of New York.
Marquez-Marquez is in custody in South Dakota and is awaiting transport to New York.
The U.S. Attorney’s Office explains that the charges they face each carry potential maximum penalties of 5 or 10 years in prison, depending on the specific count.
Fines can reach up to $250,000 per count, along with supervised release terms of up to three years.
Importantly, federal authorities stress that these are still just accusations.
The press release explicitly notes that all six men are presumed innocent unless and until proven guilty in court.
That reminder matters.
Even in a case that sounds airtight on paper, with timelines and malware and coordinated hits, the burden is still on prosecutors to prove their case beyond a reasonable doubt.
A Growing National Threat To ATMs
Hayes ties this case to a larger national trend.
She points out that in June, the U.S. Secret Service issued a report warning of an uptick in ATM jackpotting incidents.
That report, according to Hayes, said the agency had seen attacks in at least 15 states, including New York.
It also suggested that multiple brands of ATMs were being targeted and that at least seven different “criminal groups” were believed to be behind them.
That context is important.
It suggests that what allegedly happened in Syracuse, Binghamton, and Norwich isn’t a one-off incident, but part of a coordinated strategy by organized crews moving across the country.
From a security standpoint, jackpotting hits a nightmare sweet spot.
It combines old-school physical access – opening a cabinet, using a key – with modern cyber intrusion, leveraging malware to override the machine’s controls.
Banks and credit unions have responded over the years by hardening software, patching vulnerabilities, and upgrading hardware.
But as this indictment shows, determined groups are still finding ways in.
Why This Case Matters To Regular Bank Customers
On the surface, it might be tempting for everyday customers to shrug this off.
After all, as both the U.S. Attorney’s Office and Anne Hayes explain, jackpotting attacks drain the ATM’s own cash, not individual accounts.
But there are real downstream effects.
Financial institutions that eat six-figure losses have to make that money up somewhere — through higher fees, tighter withdrawal limits, or reduced investment in other services.
There’s also the psychological hit.
When people see stories about ATMs being hacked so they spit out hundreds of thousands in cash, it erodes confidence in the systems we all use every day.
On the flip side, this case also shows a fairly robust law-enforcement response.
The U.S. Attorney’s Office credits the FBI’s Albany Field Office with leading the investigation and lists a long roster of agencies that helped chase the crew across multiple states.
According to the press release, those partners include U.S. Immigration and Customs Enforcement, Customs and Border Protection, the U.S. Secret Service, New York State Police, three county sheriff’s offices, several local police departments in New York, and even departments as far away as Dearborn, Michigan and Belle Fourche, South Dakota.
That kind of multi-agency coordination is exactly what you’d expect when the alleged crime is mobile, technical, and crosses state lines.
If the government wants to send a deterrent message to other jackpotting crews, a high-profile, multi-jurisdictional case like this is one way to do it.
In the end, this indictment is about more than six Venezuelan nationals and four Upstate ATMs.
It’s a snapshot of how modern financial crime looks in 2023: fast, tech-savvy, and willing to travel anywhere a vulnerable machine and a stack of cash can be found.
Whether prosecutors can turn that snapshot into convictions is now up to the courts.
But the warning to banks, credit unions, and customers is already loud and clear – the battle over who controls the ATM is far from over.
Raised in a small Arizona town, Kevin grew up surrounded by rugged desert landscapes and a family of hunters. His background in competitive shooting and firearms training has made him an authority on self-defense and gun safety. A certified firearms instructor, Kevin teaches others how to properly handle and maintain their weapons, whether for hunting, home defense, or survival situations. His writing focuses on responsible gun ownership, marksmanship, and the role of firearms in personal preparedness.
