ATMs generally connect to a management system to retrieve configuration and report status. Like many back-end systems, these are often poorly designed and don't

ATMs generally connect to a management system to retrieve configuration and report status. Like many back-end systems, these are often poorly designed and don't receive extensive security review. So if you can compromise one, there's an opportunity to potentially deliver a malicious configuration to a large number of machines at once. Similarly, there are several ways that attackers can find ATMs on the internet or telephone system in bulk. Although the situation has improved, ATMs historically had very poor authentication for remote management (some likely still do) which made them vulnerable to malicious reconfiguration over the internet or telephone modem.