Staples hackers created more than 15,000 gift cards, then went on a shopping spree

Hackers gained unauthorized access to Staples' customer-service system and created more than 15,000 gift cards, valued at over $5 million, according to a newly unsealed search warrant application. The breach connected a corporate software intrusion to an organized retail theft operation, enabling the group to convert unauthorized system access into merchandise.

The attackers obtained session data from the memory of the retailer's support application, which they believed was only accessible from their own computers. Chinese organized crime members exploited this vulnerability to generate gift cards for retailers like Target and Sephora. They then used the cards to purchase electronics and other merchandise, much of which was shipped to China.

The compromised system, known as Nexus, is an internal customer-support application used by Staples. The hackers reached Nexus from outside the company's network, making multiple heap-dump requests to capture the application's memory and hijack customer-service representative sessions. Using these authenticated sessions, they issued gift cards and sent them to controlled email addresses.

The operation was part of a larger gift card conspiracy involving warehouses and shipping goods to China. The Justice Department sentenced three Chinese nationals involved in the scheme, but did not specifically name Staples. The broader group amassed over $100 million in gift cards across various retailers.