A Chinese organized crime ring hacked Staples, fraudulently issued gift cards worth over $5 million, then went on a nationwide shopping spree and shipped stolen goods back to China.
Staples was hacked by a Chinese crime ring. They broke into its internal system and fraudulently issued more than 15,000 gift cards worth over $5 million, then used them to buy out stores like Target and Sephora before shipping the loot back to China.
The break-in started inside
In October 2023, Homeland Security Investigations learned that hackers reached Staples' internal customer-support system, Nexus, from outside. They first ran heap dumps to capture logged-in representatives' sessions, then hijacked those sessions to issue gift cards in bulk to email accounts they controlled.
A familiar hauling crew
Members of the gang then went shopping. Surveillance footage from a New Hampshire Target showed four men using phones to scan 35 gift cards in one hour, buying Apple, Bose and other electronics. Staff knew them well: they came almost every day and never ran out of cards.
Target data showed the group used 3,850 cards at 85 stores across 18 states in two days, spending about $141,000. Sephora and Lowe's were also hit. In the end, 4,630 cards were redeemed for around $425,000.
An earlier prosecution tied the ring to gift cards worth over $100 million in total. These defendants were one link in the chain, monetizing cards obtained by hackers and scammers.
Why it matters
The case exposes a soft spot in retail: the target is not just money but the enterprise permission system itself. One vulnerability let a crime ring tap gift cards like an ATM across the country, while merchants and investigators could only chase the fraud after the fact.
Curated from high-quality sources, with concise summaries and key takeaways.
