Bulgarian man arrested for allegedly tampering with 13 ATMs in Bangkok and suburbs

Bulgarian man arrested for allegedly planting devices in 13 ATMs across Bangkok to steal user data via SIM-equipped cables and “jackpot” virus.

Cybercrime police have arrested a Bulgarian national for allegedly installing data-trapping devices in 13 ATM machines across Bangkok and Nonthaburi, in a suspected attempt to steal sensitive banking information from users.

Arrest Announced by Cyber Crime Investigation Division

The Cyber Crime Investigation Division 2 announced the arrest of Ivan Valchev, 50, at its headquarters on Wednesday. Valchev was apprehended on Tuesday at a luxury residence in Pak Kret district, Nonthaburi, under an arrest warrant issued by the Criminal Court on 26 May.

Modified Cables Allegedly Used to Disrupt ATM Operations

According to Police Major General Siriwat Deepor, commander of the division, Valchev allegedly removed the original data cables from 13 ATMs and replaced them with modified cables embedded with SIM cards. These were allegedly used to plant a "jackpot" virus into the banking systems, which disrupted the normal operation of the machines and prevented customers from withdrawing money.

Siriwat said the attack posed a serious threat to the country’s financial security.

Devices May Have Stolen ATM User Data via SIM Cards

Cybersecurity experts suspect the implanted devices may have been designed to intercept sensitive data entered by ATM users. The SIM cards could then have transmitted the stolen data to email accounts controlled by hackers, who would use it to access victims' bank accounts.

Suspects Disguised as Technicians to Access ATMs

Banks had earlier alerted cybercrime police in March about criminals posing as technicians to access ATM systems. Using what appeared to be a master key, the suspects opened the control panels of ATMs located in Bangkok, Nonthaburi, Pathum Thani, and Chonburi.

Surveillance Footage Leads to Suspect Identification

Security camera footage showed two to three individuals tampering with ATMs and arriving in a white Honda City. Police traced the vehicle to a rental company, which identified Valchev as the person who had rented the car.

Seized Equipment and Ongoing Investigation

During the raid, police seized notebook computers, numerous data cables, and electronic devices. While Valchev admitted ownership of the equipment, he denied involvement in any criminal activity.
Police are continuing their investigation to identify and locate Valchev’s accomplices.

(2025/05/28-00:00)