In the Sheridan Police Department police report, the word “jackpotting” is used in describing the Peoples Bank ATM theft.

But what is it?

In February, the FBI released a Flash report about the increased in ATM "jackpotting.” This kind of theft uses that malware to force a machine to dispense cash without any real transaction or bank authorization.

The FBI reported approximately 1,900 jackpotting incidents nationwide since 2020. More than 700 of those, with combined losses exceeding $20 million, occurred in 2025 alone, according to the report.

Jackpotting attacks typically begin with physical access to the machine. How? Generic keys, according to the FBI, are widely available for purchase and can tamper with the ATM's internal hard drive.

Criminals either remove the drive, load malware onto it on their own computer, and reinstall it, or swap in a completely different drive preloaded with malicious software before rebooting the machine.

The report identifies the Ploutus malware family as a leading tool in these attacks.

Once installed, the report says Ploutus lets criminals bypass a bank's authorization systems entirely and issue direct commands to the ATM's dispensing hardware. This allows a fast cash-out that can take only minutes. It often isn't discovered until after the money is gone.

Such is the case with the Peoples Bank theft.

The FBI description lines up closely with what a bank-contracted technician found when he examined the People's Bank ATM after the June 28-29 theft.

As Grant County Fire reported Wednesday, Kevin Davis, a technician, discovered missing parts including the enclosure protecting the machine's hard drives and the screws meant to secure it. The positioning of parts was also not correct.

The FBI bulletin lists hard drive removal and irregular positioning as physical warning signs of jackpotting, alongside unexplained "out of service" status and door-open alerts outside normal maintenance windows.

Sheridan police collected two hard drives as evidence from the machine — a Crucial by Micron drive and an Avant drive — which are consistent with the kind of hardware criminals are known to swap or reprogram during these attacks, according to the bulletin's technical details.

In its February report, the FBI asks financial institutions and ATM operators to report jackpotting incidents to their local field office or the FBI's Internet Crime Complaint Center at ic3.gov. The FBI requests banks to provide details including the bank's location, the ATM's manufacturer and vendor, and any available security logs.

As previously reported, the Sheridan case remains an active investigation, and the FBI has since become involved, according to information shared at Tuesday night’s Sheridan City Council meeting.