On 24 August 2026 the US Justice Department announced a 96-month federal prison sentence — eight years, plus five years of supervised release — for Juan Manuel Gouveia-Aguilera, 27, a Venezuelan national.

The DoJ describes it as the longest federal sentence imposed for an individual's role in ATM jackpotting. Over $3.5 million in losses is attributed to him.

How the attack works

Remove the ATM's exterior casing. Connect a laptop. Install malware. Instruct the machine to dispense all of its cash.

That is the technique. There is no network intrusion, no credential theft, and no card data involved. The attacker gets physical access to the machine's internals and speaks directly to the cash dispenser.

It works because of an architectural assumption that predates the threat: the computer inside an ATM trusts the dispenser and the dispenser trusts the computer, and the security boundary protecting that conversation is the metal box around both of them. Once the box is open, the software has no way to tell a criminal's laptop from the machine's own controller.

The charges are the giveaway

Gouveia-Aguilera was convicted of bank fraud, bank burglary, and cyber-enabled fraud.

Burglary. That word is doing real work in a story people file under cybercrime. This is a physical break-in with a software payload, and the sentence reflects the physical half as much as the technical one.

The scale nobody sees

He is one of 119 individuals charged with ATM jackpotting in Nebraska alone, allegedly working for the Venezuelan organisation Tren de Aragua. Two other Venezuelan nationals received 78-month sentences weeks earlier for similar offences.

Nationally, roughly 1,900 jackpotting attacks have been reported since 2020, and 2025 incidents alone caused losses exceeding $20 million.

One hundred and nineteen defendants in one state is not a hacking crew. It is a labour force. The malware and the technique are built once; what scales is the number of people willing to stand at a machine at three in the morning with a screwdriver, and the ability to move them.

That is the same economic shape as the ransomware affiliate model and as a command-and-control framework selling for $99.99: the technical work is centralised and cheap, and the operation scales by recruiting people who do not need to understand it.

Why the sentence is the news

Eight years is not the largest financial-crime sentence handed down this year. It is the largest for this offence, and that is a signal about how prosecutors have decided to treat it.

Jackpotting has historically been charged as theft or burglary and sentenced accordingly. Adding cyber-enabled fraud and pushing the term to 96 months reframes it as something closer to an intrusion offence. Whether that deters anyone is a separate question — deterrence assumes the person at the machine is weighing sentencing guidelines, and the recruitment model this depends on suggests many of them are not the ones capturing the money.

Two others at 78 months, this one at 96, and 116 more cases still moving through one state's courts. The trend line in the sentences is easier to read than the trend line in the attacks.

For banks and ATM operators

The defences are physical and procedural, not clever:

  • Alarms on the top-box or fascia. The attack requires opening the enclosure, which is a detectable event.
  • Full-disk encryption and secure boot on the ATM PC, so an attacker's code cannot simply be loaded.
  • Authenticated communication between the PC and the dispenser — the control that would defeat the technique outright, and the one that legacy fleets most often lack.
  • Cash-level and dispense-rate alerting. A machine emptying itself in minutes is an anomaly that can be detected in real time.
  • Prioritise standalone machines. Retail and off-premises ATMs are chosen because nobody is watching them.

What is not established

  • Which states the offences occurred in, beyond the Nebraska charging venue.
  • The exact dates of the offences.
  • How many machines he personally targeted.
  • How the malware reached the group, or who wrote it.
  • The status of the other 118 defendants. Charged is not convicted.