Three people are in U.S. District Court for the Southern District of New York on charges they stole ATM PIN numbers enabling them to grab at least $2 million from Citibank checking and savings accounts.

Although the extent of the breach is unknown, the alleged crooks pilfered the PINs between October 2007 and March when bank customers used ATMS inside an unknown number of 7-Eleven stores. Around 5,700 Citibank ATMs are located in U.S. 7-Elevens. However, the bank neither owns or operates the automatic tellers.

Unlike previous PIN thefts, which relied on obvious methods to get bank account passwords, the trio charged apparently sniffed the personal data while it was being transmitted between the ATMs and the computer system that authorizes transactions. One likely route was the Internet connection used to maintain the ATMs, security analysts told the New York Times Wednesday.

Yuriy Rakushchynets, Ivan Biltse and Angelina Kitaeva were arrested by the FBI in February and charged each with two counts of fraud and conspiracy.

The ATMs are owned and largely operated by Cardtronics Inc. with Fiserv Inc. operating the remaining machines. Cardtronics told the New York Times it is cooperating with the investigation while Fiserv said its computers were not involved in the ATM PIN thefts.