Bank of Montreal Data Breach (2014)

Two students used a manual found online to gain administrative access to an ATM. They issued a default credential to access the device. They disclosed the issue immediately to a bank branch (the bank ATM resided at a retail location) and were given permission to prove their access. So they printed out sensitive information, changed the surcharge fee and changed the banner.