Some of the world’s banks likely had a crummy Valentine’s Day after a new report from a computer-security firm came out this weekend, saying that a group of criminals has stolen millions of dollars since late 2013 from financial institutions in Russia, Eastern Europe and the United States. And it doesn’t seem like they’re done yet.

A report from Russian computer-security firm Kaspersky Lab Zao outlines the ways in which the cyber criminals were able to hack into ATMs so that they would spew out cash for criminals and move funds around between accounts without anyone being any the wiser, reports the Wall Street Journal.

People familiar with the briefings told the WSJ that some financial-services executives in the U.S. have been briefed on the report, as well as government officials. Kaspersky filled in a computer-security trade group for U.S. banks on his findings, but that group didn’t immediately raise its threat level, an insider told the WSJ.

The report details how the thieves would capture video of what bank workers were viewing on their computer screens at work, and then learned from there how to copy how employees access the banks’ systems. The criminals would then hack into the computers that control ATMs and basically make them do their bidding.

The security group estimates that all told, hackers were able to steal $1 billion since late 2013, many times exploiting weaknesses in Microsoft software for ATMs. While Microsoft issued patches for those holes, if a company didn’t update their software, that provided an easier way in for the hackers.

Where the hackers are is another question, as there are servers based in China that they’re using while some Web domains are registered to Chinese nationals — which are all things that have been faked in the past.

It’s unclear which banks were hit, or how many, though the report says it could be as many as 100 financial institutions. The report indicates that most of the banks that were hit appear to be in Russia, with 178 targeted IP addresses coming from that country and 37 linked to the U.S. Those numbers don’t necessarily correlate to the number of banks hit or indicate separate institutions.

While Kaspersky’s findings say there doesn’t seem to be any sign that the hackers are done with bank-robbing, the good(ish) news for customers is that it seems the attacks are targeting the banks themselves rather than their customers and their account information, Kaspersky principal researcher Vicente Dias told the Associated Press.

Basically, they’re in it for the dough.

“In this case they are not interested in information. They’re only interested in the money,” he said. “They’re flexible and quite aggressive and use any tool they find useful for doing whatever they want to do.”

New Report Says Computer Criminals Stole Millions From Banks [Wall Street Journal]
Hackers steal up to $1 billion from banks, security co. says [Associated Press]

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.