Chinese crime ring steals more than $5 million in gift cards from Staples customer service

In 2023, a Chinese crime ring infiltrated an internal Staples system and issued over 15,000 gift cards, which were subsequently used to purchase high-end technology at retailers such as Target, Sephora, and Lowe's. This malicious activity went unnoticed until a search warrant was unsealed last week, revealing that Homeland Security Investigations (HSI) had been alerted about the hack in October of that year.

The victim company, headquartered in Massachusetts, utilizes Blackhawk Networks for gift card orders and a customer support system named Nexus. The hack was possible because hackers discovered a method to bypass Nexus' perceived secure network access. They utilized a process called heap dump requests, which extracts all data from an application's memory, enabling them to hijack customer service employee sessions.

Armed with this information, the criminals issued gift cards at will and dispatched runners to retail outlets to spend them before they could be identified and canceled. Target experienced significant losses, with 35 gift cards being used in a single hour at a New Hampshire store for high-value purchases such as Apple, Bose, and Beats products, totaling $140,000 in just two days.

Sephora suffered $58,600 in sales, and Lowe's incurred $226,000 in total losses across online and in-store purchases. Altogether, 4,630 stolen gift cards were utilized, amounting to approximately $425,000 in fraudulent spending. The incident is part of a larger pattern of Chinese organized crime groups targeting U.S. businesses; last April, three Chinese nationals were sentenced for their roles in a gift card fraud conspiracy that resulted in losses exceeding $100 million.