Sophisticated ATM Hack in Croatia: Nearly a Quarter Million Euros Stolen

Croatian investigators are unraveling an international criminal network that stole nearly 250,000 euros from a Croatian bank using a sophisticated computer attack on an ATM. The case is particularly interesting because, until now, thieves in Croatia have mostly relied on explosions to break into ATMs, rather than such advanced hacking methods.

The bank reported the missing money in early March 2025. The ensuing investigation revealed that someone had installed specialized electronic hacking devices on the ATM and used them to extract the cash. It has not yet been definitively determined whether this was a so-called "host spoofing" attack or a "black box" method.

How Were the Thieves Unmasked?

A key clue was found during the police investigation. Inside the ATM itself, investigators discovered an electronic device connected to its internal systems. Another piece of equipment, believed to have also been used in the attack, was found discarded in a nearby trash bin.

Following this, investigators analyzed surveillance footage and quickly established international police cooperation through Europol and Interpol. Since it was clear this was an organized international network, this cooperation yielded valuable information. The devices installed in the ATM were also examined.

Venezuelan Arrested, Fellow Nationals Sought

According to information from Index.hr, only one member of this criminal chain has been arrested in Croatia so far. The individual holds Venezuelan citizenship. The investigation also covers several of his fellow nationals, but it has not yet been confirmed whether the stolen money has been recovered.

Two Possible Attack Methods: "Host Spoofing" and "Black Box"

Investigators have not yet determined which of the two sophisticated methods was used. In host spoofing, the attacker inserts themselves into the communication between the ATM and the bank's central system that authorizes withdrawals. They intercept, alter, or replace the bank's response. For example, they can change a transaction denial message into a false approval, or their device can impersonate the bank's system and send withdrawal commands. The ATM then "believes" the transaction was properly approved, even though the bank never gave its consent.

On the other hand, in a black box attack, which falls under the category of "jackpotting" attacks, the goal is to force the ATM to dispense a large portion or all of the cash from its cassettes. Attackers physically open or damage the ATM casing to access the cables connected to the cash dispensing module. They attach their own device, a so-called black box, which directly sends commands to dispense cash, completely bypassing the bank's normal authorization system.

Both methods differ significantly from skimming, whose primary goal is to steal card data and PINs, rather than directly causing unauthorized cash withdrawals.