Evidence of fraud is starting to emerge.

"In the last week, we've begun to see some indications of fraud," Birch revealed, adding that no exact count is available because the situation continues to evolve. "It is a substantial number, but certainly not all of them."

The institution actively reached out with a website alert and letter to affected members.

"We have become aware that your debit card is vulnerable to potential fraud as a result of fraudsters placing a card skimming device on an ATM that you used," the letter read. "The debit card information that may be at risk includes your name, card number, expiration date and personal identification number (PIN)."

Birch explained the normal pattern in these types of incidents is for fraudsters to visit ATMs, often at night, and then install unauthorized skimming devices to collect card data. They return sometime later, after some members have used the device to collect that information. They then used data to manufacture fake cards, which they then use to make withdrawals.

The credit union's ATM machines work with cards that have mag stripes.

"Our debit cards don't have the EMV chip at this point," Birch said. "We anticipate doing that in the future, not the distant future, but the future. We do have the EMV chip on our credit cards but the mag stripe is still there [on debit cards] because retailers require it. These incidents are happening up and down the east coast, and elsewhere in the country as well."

John Zurawski, vice president of Chicago-based Authentify, a supplier of authentication services for protecting user accounts from unauthorized access, said, "The most recent study by the Federal Reserve on the use of ATMs included the statistic that American consumers made 5.8 billion ATM withdrawals totaling $687 billion in value annually. It's not surprising that criminals have targeted ATMs, in fact, the Secret Service has warned of an uptick in this type of crime. The risk of getting caught is low, the rewards are potentially high as debit cards can be used at ATMs or online."

Zurawski pointed to a 2015 study by the Federal Reserve Board on the U.S. payments systems, which cites sub-optimal security technologies and the need to "strengthen authorization and authentication of parties and devices across all payment methods (cards, ACH, wire, check) and channels (in person, remote, mobile, and online)."

"Would biometrics at the ATM or out-of-band authentication of the legitimate account holder via their phone fill that sub-optimal gap and prevent this type of crime?" he asked. "Yes it would!"