Hackers used infected USBs to make ATMs spit out cash