Diebold, which supplies ATMs around the world to companies including the Co-operative Bank in the UK, has had cash machines hacked with Trojan malware in Russia.
Sophos first flagged the discovery of malware targeting Diebold machines after analysing code sent to various security companies called Troj/Skimer-A. This contained references to Diebold DLLs and appeared to be sending instructions that could steal PINs and information from cards entered in its ATMs.
Diebold told IDG News Service that it had already started warning customers in January that criminals in Russia were breaking into its Diebold ATMs to install card-sniffing software.
In a letter sent out to customers, Diebold's chief security officer Scott Angelo said that although the crime was isolated to Russia, it had taken the precaution of providing a software update for all of its Windows- based ATMs globally.
He said that Diebold believed the update would help prevent the attack in Russia from occurring at Diebold ATMs in the future.
Graham Cluley, security consultant for Sophos, said an attack on UK ATMs was not impossible, but that the main constraint on hackers was that they needed to have access to the machine.
"We don't think these hackers gained access to these machines on the High Street, because they would have alarms and tamper sensors," he said. "It would normally have to be an inside job, or perhaps the machine was interfered with along the production line in some way to install the code."
He added that there was the potential for any device, if they had to be updated, to be tampered with.
It isn't the first time that IT PRO has reported about the threat of ATM hacking. Last year security firm Network box claimed that ATMs were less secure due to more cash machines being built with PC operating systems.
Cluley said: "The banks need to have tight controls over who accesses these devices, and to make sure they haven't been altered in terms of their software."
Diebold said it was working with customers to install security enhancements to mitigate the threat, and were reviewing physical and logical security measures - which was ongoing.
The Co-operative Bank has replied to IT PRO's request for comment at the time of writing.
