Thanks to Wineboffin for this lead in the Citibank ATM case.  This news.com article quotes police in Leonminster, Mass here, indicating that it was not ATM fraud, but rather fraud at a merchant, OfficeMax, that compromised the debit cards.

New debit card fraud tied to West Coast case | CNET News.com

“I thought that the thefts may have involved a skimming device installed at local ATMs,” Wolferseder said. “Now I’m following up this OfficeMax connection.”

The story indicates a massive debit card replacement took place recently on the US west coast, that involved several big banks.

Two banking sources, speaking on condition of anonymity, said the
recent cases are tied to the massive debit-card replacement on the West
Coast last month. In that case, Bank of America, Washington Mutual and
other banks notified customers that a security breach at an undisclosed
merchant had forced them to take precautions.