So they run "embedded Windows XP" (never heard of that). So?
What I want to know is how they could get infected by a virus? Are they trying to say that the ATMs are connected to the Internet? Not even a VPN?
Now THAT would be scary. They could be running OpenBSD for all I care, it still seems stupid.
