What we know so far: Hackers took over Staples customer-service sessions and used them to issue more than 15,000 gift cards worth over $5 million, according to a newly unsealed search warrant application. The breach linked a corporate software intrusion to an organized retail theft operation, letting the group turn unauthorized system access into merchandise. It also exposed how weaknesses in one company's internal tools could support fraud across multiple retailers.
The attackers obtained the session data from the memory of a support application the retailer believed could only be reached from its own computers. The breach gave a Chinese organized crime group a way to generate gift cards for retailers including Target and Sephora. Members of the operation then used the cards to buy electronics and other merchandise, much of which was shipped to China.
The court document describes the compromised system as Nexus, an internal customer-support application. It does not name Staples, but 404 Media identified the company through its Massachusetts headquarters, its use of Blackhawk Network to fulfill gift card orders and the Nexus name. The publication also found a reference to Nexus on a former Staples executive's LinkedIn profile.
Staples did not respond to 404 Media's requests for comment.
The hackers reached Nexus from outside the company's network and made multiple heap-dump requests, the warrant application says. A heap dump captures the data held in an application's memory at a given moment.
The information returned by those requests allowed the attackers to hijack sessions belonging to customer-service representatives who were already logged in. They then used those sessions to issue gift cards and send them to email addresses they controlled.
The document describes how the attackers moved from application-memory data to authenticated employee sessions. It does not establish how they first gained outside access to Nexus.
Homeland Security Investigations learned of the attack in October 2023, when the company reported that more than 15,000 gift cards had been fraudulently issued through its systems.
Once the cards reached the group's email accounts, participants could display them on their phones for cashiers to scan.
At a Target in New Hampshire, 35 gift cards linked to the Staples breach were used within one hour to buy Apple, Bose and Powerbeats products. The purchases also involved cards from other sources.
Surveillance footage showed four men approaching checkout counters one after another, sometimes interacting with each other and the cashiers. Investigators described the men presenting a card on a phone, having it scanned, then finding another card and repeating the process until they had used all the cards available to them.
Target employees told investigators the men visited almost daily and regularly made large purchases of Apple products with gift cards.
Records from other stores showed the scale of the spending. Target identified 3,850 cards worth about $141,000 that were used in 300 transactions across 85 stores in 18 states over two days.
Sephora reported that about 330 cards worth $58,600 had been redeemed online across 1,500 transactions. Lowe's reported 450 cards totaling $226,000 used online and in person at more than 22 locations.
In total, the group redeemed about 4,630 cards from the breach, worth about $425,000. That was only a portion of the more than $5 million in cards the hackers had issued.
The breach was linked to a larger gift card conspiracy that used warehouses to hold merchandise before shipping goods to China. The Justice Department announced prison sentences for three Chinese nationals involved in the operation in April. Its announcement mentioned attacks on US businesses but did not identify Staples.
The broader group acquired more than $100 million in gift cards.