State charges now added in Texas Panhandle, South Plains ATM jackpotting case

Investigators believe three Miami men accused of hacking ATMs in Lubbock and Herford also stole hundreds of thousands of dollars from two machines in Amarillo, according to federal court records.

Meanwhile, Carlos Herrera-Ruiz, 34, Abel Valdes, 38 and Yordanesz Sanchez, 41, now face state-level charges after a Lubbock County grand jury on Tuesday returned indictments charging them each with a count of theft of less than $300,000 from an automated teller machine, second degree felony that carries a punishment of two to 20 years in prison.

They are accused of stealing more than $5,000 in June from a West Lubbock convenience store.

However, court documents state that investigators believe the three men stole about $114,760 from ATMs in Amarillo, Herford and Lubbock.

The men were first indicted in August in federal court on charges of use of an unauthorized access device.

The three pleaded not guilty to the federal charges. Valdes and Yordanesz, who jail records state are Cuban nationals, entered their pleas via a Spanish language interpreter, court records show.

U.S. Magistrate judge D. Gordon Bryant initially set an Oct. 2 trial date for the three. However, a new trial date for January was set after federal prosecutors filed a motion for continuance, citing the complex nature of the case and the ongoing nature of the investigation.

"The United States represents to the court that this case is so unusual and so complex, due to the complex and time-consuming nature of the discovery, the ongoing investigation, the need to forensically examine many devices and translate the material into English, and the possibility of locating additional co-conspirators, it is unreasonable to expect adequate preparation for pretrial proceedings or for the trial within the time limits established by the Speedy Trial Act," the government's motion reads.

The three men were booked-in at the Lubbock County Detention Center after their Aug. 3 arrests at the Red Roof Inn in the 6600 block of I-27. Jail records state they have addresses in Miami.

The charges against Herrera-Ruiz, Valdes and Yordanesz stem from a Texas Financial Crimes Intelligence Center investigation aided by the Lubbock Police Department.

An agent with the TFCIC told Lubbock police he believed a crew of ATM jackpotters who operated in the South Plains region were at a hotel in the city.

ATM jackpotting, as described by the U.S. Secret Service, falls under the umbrella of an unlimited ATM cash-out attack. Jackpotting thieves typically use computers they plug into free standing ATMs to install malicious software on the machines and force them to dispense cash on demand.

Court documents indicate the first jackpotting attack the men are accused of executing was in late June at a convenience store in West Lubbock.

An employee for the ATM called police on June 30 after he discovered money from the machine was missing and unaccounted for.

The employee told police the ATM was filled three days before. However, two days later, the machine was being serviced for a disabled pin pad. After the machine was repaired, the employee reviewed recent transactions on the machine and discovered there was money missing that wasn't recorded.

Footage from the convenience store's security cameras captured two thieves approaching the machine and taking money from it without any force.

One of the thieves could be seen signaling his partner when an employee or customer would approach the part of the store where they were and the men would move to another part of the store only to return when the ATM area was clear of other people, according to a police report.

At one point in the video one of the thieves handed some of the money to the other.

A probable cause affidavit filed in the case indicated investigators believe the men used a Raspberry Pi, a micro computer that's about the size of a credit card, to plug into ATMs and overcome their security protocols and gain access to the cash drawer.

The thieves stole more than $5,700 from the ATM, according to court documents.

A month later, court documents state the men attacked an ATM at a supermarket in Herford and stole about $3,600.

Surveillance footage and other sources linked the men to attacks of two ATMs in Amarillo. Investigators believe the men stole about $38,400 after hacking a Happy State Bank ATM in Amarillo between June 30 to July 28.

The last attack investigator have so far linked to the men was an Aug. 2 heist when $67,000 was stolen from an Amarillo National Bank ATM.

Herrera-Ruiz, Valdes and Yordanesz were identified as the jackpotting thieves after an agent with the Texas Financial Crimes Intelligence Center informed Lubbock police on Aug. 3 that a black Honda Civic with Florida license plates used by thieves in the Herford jackpotting case was photographed by the License Plate Reader System at the Red Roof Inn in the 6600 block of I-27.

The vehicle's plates were also scanned at a Motel 6 a day after the convenience store ATM hack.

One of the thieves captured on video by security cameras from the Herford case also appeared to be wearing the same clothing and resembled one of the thieves in the convenience store jackpotting hack, court documents state.

Investigators believed the men sent the stolen money through several Western Union offices inside supermarkets in Lubbock and Amarillo.

A warranted search of the Red Roof Inn room rented in Herrera-Ruiz's name, yielded evidence including dozens of computer parts, a computer in the form of a USB stick, credit card swipe readers, a police scanner and more than a dozen debit cards, according to court documents.

Investigators also found two Raspberry Pi devices in the hotel room.

This article originally appeared on Lubbock Avalanche-Journal: State charges added Texas Panhandle, South Plains ATM jackpotting case