In October 2023, a Chinese organised crime group infiltrated Staples and issued over 15,000 gift cards worth more than $5 million. They then used those cards to buy electronics at Target, Sephora, and Lowe’s before shipping the stolen goods back to China.
Homeland Security Investigations received the initial report from an office supply firm. A search warrant application unsealed last week provided the details. The document does not name the victim company, but 404 Media identified it as Staples. The firm is based in Massachusetts, uses Blackhawk Network for gift cards, and operates an internal support system called Nexus. A reference to Nexus appears on a former Staples executive’s LinkedIn profile.
Staples did not respond to requests for comment.
The technical breach
Staples assumed Nexus was only accessible from internal computers. The attackers found a way to reach it from the outside. They performed multiple heap dump requests to capture data held in the app’s memory at a specific moment. This allowed them to hijack the sessions of logged-in customer service representatives. The gang then used those sessions to issue the wave of gift cards.
The hackers sent the cards to email accounts they controlled. Gang members then spent them at retail locations. At one Target in New Hampshire, 35 cards from the Staples hack were used in just one hour. The purchases included Apple, Bose, and Powerbeats products. The cards came from the Staples hack and other sources.
Surveillance footage showed four men appearing one after another. They occasionally interacted with each other and the cashiers. The men presented their cell phones to the cashier to scan the electronic Target gift card displayed on the screen. After scanning one card, all four would use their phones to access another electronic gift card and present it for scanning. They repeated this until they exhausted the cards available on their phones.
Target employees said the four men were well known to staff. They came into the store almost every day to make numerous large purchases of Apple products using gift cards.
The scale of the theft
Target data showed crooks used 3,850 gift cards worth around $141,000 at 85 different stores in 18 states across two days. That encompassed 300 individual transactions. Sephora told investigators the gang redeemed around 330 gift cards worth $58,600 online across 1,500 transactions. Lowe’s had 450 gift cards totalling $226,000 redeemed in person and online at more than 22 locations.
Ultimately, the gang used 4,630 of the hacked gift cards. The total value reached around $425,000.
A broader operation
This hack relates to a previously announced prosecution of a retail theft ring. In April, the Department of Justice announced three Chinese nationals were sentenced for their roles in the gift card fraud conspiracy. The newly unsealed document reveals the Staples hack, but the ring was bigger in scope than the document suggests. The group acquired more than $100 million worth of gift cards.
The press release mentioned the hacking of U.S. companies but did not name Staples. Thomas Demeo, Acting Special Agent in Charge of the Internal Revenue Service Criminal Investigation, Boston Field Office, said the defendants acted as an integral cog of this international scheme. He stated the group monetised ill-gotten gains obtained by Chinese hackers and scammers that victimised U.S. businesses and citizens. IRS-CI is committed to continued collaboration with law enforcement partners, both at home and abroad, to stop and deter anyone who seeks to profit off the hard work of U.S. citizens.
What it means
Organised crime is moving beyond simple online fraud. The operation now involves physical warehouses to store stolen merchandise and coordinated teams to spend cards in person. Retailers face a dual threat: digital breaches to generate funds and physical presence to liquidate high-value items like electronics. The speed of the spending, such as the rapid use of cards at a single New Hampshire Target, suggests pre-planned execution rather than opportunistic theft.
