Yep that is stupid. It would leave an ATM open to OS types of exploits like the RPC exploit! WTF were they thinking. I could maybe see it of they had some wan for local ATMs and then concentrated the data onto a VPN at a NOC or something, but only with serious safeguards in place. To hook each ATM to the internet is bordeline negligence.