In just 12 hours, using the counterfeit cards, the cashers withdrew $9.4 million from more than 2,100 ATMs in the United States, Russia, Ukraine, Estonia, Italy, Hong Kong, Japan and Canada, says Yates.

"The technical aspects were not that impressive," says Uri Rivner, senior security analyst at RSA, The Security Division of EMC. "But the level of coordination was staggering."

Rivner says the ring leaders likely spent months on Internet forums recruiting card counterfeiters and cashers and plotting a fast-moving wave of withdrawals.

"The element of surprise allows you to do a tremendous amount of damage in a short span of time," says Rivner. "It's like an al-Qaeda strategy of multiple attacks in a single day."