...how do banks keep their ATMs safe?
Have a handful of companies sprouted after XP's end of cycle offering patches?
ATMs normally lie on a isolated network directly to the bank that owns the ATM. This is normally enforced by a VPN-router if theres no leased point-to-point line at the location, where the local end does not allow any traffic outside the VPN, even if malicious software on the ATM deliberately tried, and the remote end's firewall is configured to not allow any traffic other than is required for ATM operation.
This means normally that the ATM does not have access to the internet, nor does the internet have access to the ATM.
As the customer also never gets to have any physical input to the ATM, like usb, keyboard or mouse, rather the customer input via cardreader, pinpad and screen selection buttons, are managed via RS232, and similiar interfaces, so the ATM software has full control and customer cannot send any data to the underlying operating system, the ATM can be considered being isolated and safe.
Thus: Since theres no possibility to inject malicious software, neither via the local console (if you don't have the keycard to open the restocking/maintenace room, but then the security of the ATM computer is less of a issue since if unautorized access has happened to that room, ATM is usually replaced as a precautionary measure), and neither via the internet, unless you do have access to the bank's server hall where the VPN terminates. There cannot be malware or hacks on the ATM in the first place, regardless of the security of the OS.
And in addition, even if someone managed, despite all security measures, to plant some sort of malware on the machine, the malware cannot send its data anywhere.
Communication with the card reader, pinpad and cash unit is usually encrypted end2end.
In other words, by planting malware on a ATM, you would just get a fancy receipt printer, or you can prank the user by changing the amount the user want to withdraw - eg user select "10$" but a "50$" bill comes out and "50$" is pulled from account (and most users would regard the ATM as broken and depoist the sum they got "too much")
So the security of the operating system on a ATM does not really matter. The security around is normally so tight so it compensates.
In addition, some newer ATM provisions their operating system and relevant ATM software via PXE, and reboots regularly, to clear out all and any unauthorized changes to the system installed on the ATM.
Microsoft is supporting Windows XP under certain circumstances
As this article states the US Navy has re-upped support for their Windows XP footprint for another year as of 2015.
Microsoft is supporting the operating system from several aspects under these special agreements.
Customer Technical Support
Due to the high level of adoption from institutions that are critical to our nations infrastructure from banking to military, Microsoft kept behind some of it's Windows XP development team and created support agreements that they will offer under 'special' circumstances.
The Navy is paying $9 million per year for this agreement.
Here are some additional dates for end of 'extended support' for SQL 2005 and Exchange 2003.
Additional link regarding Microsoft 'extended support'.
As answers state above, it isn't just about updates to the system. Its also about the "attack surface" the system presents. If a means of attack is simply cut off (because of system security restrictions, software not installed or not enabled, firewall or network access blocks, etc) then the user can't attack through that route.
Quick examples to show what I mean: If you dont have the right to install new executables or replace DLLs without some security method applying, then weaknesses you could introduce that way aren't applicable unless you also have a weakness in that security system as well. No email installed / locked down browser scope, would automatically limit vulnerabilities available if emails could be clicked or arbitrary web pages opened, even if those vulnerabilities themselves still exist.
If you lock down the whole computer, run only a single application, allow it to securely connect (even through open internet) only to a particular server (that you control), but block all incoming requests from the internet, then there are practically no vulnerability delivery ways to exploit.
A new 0-day would be only a concern if it could somehow get onto the target system.
And by the way: "XP" is still getting updates