< knowing absolutely nothing about how BoA ATM's work >
It could be that BoA's network wasn't flooded / servers infected, but that the ATM's do not dial BoA directly, and dial somewhere else (ie, maybe some kind of ATM Dial Provider, nationwide wholesale, etc), and then tunnel back to BoA to get the data. Could be that the upstream of either the dial provider, or BoA was just flooded...
Again, that design makes nearly no sense. The vast majority of the ATMs that banks own and operate directly are located in the LATAs with bank branches. Those branches do have good connectivity to the bank processing centers be that via dedicated links, VPN or carrier pigeons. ATMs do have at a POTS because that is the way alarm companies monitor them. The sane design is to aggregate ATMs in zones via large branches and use branch connectivity to the processing center to provide the link. The other designs are not only more expensive but also less reliable (as we have seen here). Alex