ATMs get occasionally stolen. How easy would be for the thiefs to retieve the PINs and other information of the users that have previously used the ATM? Is there a periodic wipe of all records/logs/traces on the machine within the ATM enclosure?
My sense is that ATM transactions processing is done mostly on the server side:
An ATM is basically a safe with a PC, an LCD monitor and some additional devices. ATMs are not on the Internet...
To clarify, they are not internet-accessible in the sense that installing cracking software on an ATM would require physical access to internals of the ATM, in advance of harvesting users' data.
Typically only an encrypted version of the PIN is stored and transmitted. There are few, if any, reported incidents of customers' personal information being retrieved from stolen ATMs. Instead, card skimming (copying data from ATM cards' magnetic strip) is the primary method used for ATM fraud.
The ATM is often severely traumatized by being pulled from its concrete foundation by a truck, with a chain wrapped around it. Even if it were not irreparably damaged, the modus operandi of ATM thieves is to open the ATM with a blow torch, which would likely impair function of anything that remained. Harvesting customer PINs, after stealing the ATM, would be unlikely. Thieves empty the cash, and abandon the ATM. ATMs are typically recovered by authorities after being incinerated, buried, submerged in lakes etc.
There is no way to retrieve the PIN and other information of the user through ATM.
At max EJ (Log journal inside ATMs) logs transaction details which contain information like account number/PAN (masked)/ amount. But PIN is not logged anywhere.
Moreover, PIN is never transferred anywhere unencrypted neither it is saved anywhere in that way. As soon as you enter the PIN over the ATM keypad, the entered value gets encrypted and then passed on for transmission.
Even the Server doesn't keep PIN records. Original PINs are stored in HSMs which is a hardware device kept with Bank's server.