A Russian cybersecurity firm has issued a warning about a spate of remotely coordinated attacks on cash machines.
Hacks of banks` centralised systems had made groups of machines issue cash simultaneously, a process known as "touchless jackpotting", said Group IB.
The machines had not been physically tampered with, but "money mules" had been waiting to grab the cash and flee.
Affected countries included Armenia, Bulgaria, Estonia, the Netherlands, Poland, Russia, Spain and the UK.
But the company declined to name any specific banks.
Two cash machine manufacturers, Diebold Nixdorf and NCR Corp, told Reuters they were aware of the threat.
"They are taking this to the next level in being able to attack a large number of machines at once," said senior director Nicholas Billett, from Diebold Nixdorf.
"They know they will be caught fairly quickly, so they stage it in such a way that they can get cash from as many ATMs as they can before they get shut down."
`Follow the money`
A recent report by Europol warned of the rise of cash-machine-related malware, although it said "skimming" - using hardware to steal card information at the machine itself - was still more common.
"The new method is being done by somehow gaining access to the banks` central systems and infecting whole communities of ATMs simultaneously, hence multiplying the amount of money that can be stolen in a short time," said cybersecurity expert Prof Alan Woodward.
Because criminals were collecting the cash in person, it made the crime more difficult to trace, he added.
"The classic way of solving online financial crime is to `follow the money` - but when you can no longer do this, it is very hard to find out who is behind it, even though the evidence suggests it is a very limited number of groups that have started perpetrating this type of crime."