Credit/Shutterstock
Johnny Cruz Romero will appear in an Alabama federal court in February for allegedly participating in an ATM jackpotting scheme that stole more than $76,000 from the $184 million Heritage South Credit Union in Sylacauga, Ala.
Additionally, Wisconsin police are investigating a separate ATM jackpotting crime that victimized the $491 Simplicity Credit Union in Marshfield last month.
Romero, 44, and one other individual who has not yet been identified in court documents, allegedly carried out a “black box attack” at two ATMs at Heritage South in November. According to court documents, criminals typically hook up a Raspberry Pi device - a compact single-board computer - a portable charger and a WiFi box to an ATM and then install malware to control the ATM’s operations.
On Nov. 25, Romero and another suspect allegedly stole more than $50,000 from Heritage South's Sylacauga branch ATM within six hours. Two days later, the suspects wearing black masks allegedly stole $26,400 from the credit union’s Childersburg branch ATM over several hours. The suspects siphoned $500 at a time in denominations of $20 bills, according to court documents.
Romero was arrested on Nov. 28 after police received a report of a suspicious individual who attempted to obstruct the view of the Heritage South Sylacauga branch ATM.
“We have worked tirelessly since the breach to implement every possible security measure to safeguard against future incidents,” Heritage South President/CEO Jamie Payton said in a prepared statement.
In April, Romero was sentenced to 14 months in federal prison for his participation, along with three other men, in more than 100 ATM jackpotting attacks in Oklahoma City and throughout the region from 2021 to 2023. The fraudsters stole more than $6.5 million from ATMs owned and operated by Transfund, a subsidiary of the Bank of Oklahoma.
Although Romero was sentenced for the Oklahoma crimes nine months ago, there is no record of his incarceration, according to the Federal Bureau of Prisons. Court filings showed that after he was sentenced, Romero was ordered to be held in federal custody, but court filings did not show whether he was released.
In Marshfield, Wis., police are investigating an ATM jackpotting theft at Simplicity Credit Union from about 11 p.m. on Dec. 13 to 2 a.m. on Dec. 14.
“The unknown suspect(s) installed a malicious hard drive resulting in the ATM releasing between $60,000 and $100,000 in cash,” according to a Marshfield Police Department incident/offense report.
In a prepared statement, Simplicity said this incident was a specific and deliberate attack on its Upham Street ATM that was carried out by the suspect or suspects using external tools and malware.
Although the credit union received a low-balance alert from the ATM, the branch manager was unable to verify the low balance because the cash machine was not functioning after the malware attack, the credit union said. Simplicity reached out to a hardware vendor that confirmed someone tampered with the ATM.
Security camera photos turned over to police investigators “captured clear images of one suspect,” according to Simplicity.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
