Authorities link Staples gift-card breach to Chinese crime ring and millions in losses

A Staples breach allegedly let a Chinese organized crime ring issue more than 15,000 gift cards worth more than $5 million.

Here's what to know

An unsealed filing said Homeland Security Investigations first got word in October 2023 that hackers had compromised an office supply retailer. By matching clues in the records — a Massachusetts headquarters, Blackhawk Network gift card fulfillment, and an internal support system called Nexus — 404 Media identified the company as Staples, which did not respond to requests for comment.

Investigators alleged the attackers could reach Nexus from outside the company, even though Staples viewed the system as limited to internal computers. They then used heap-dump requests to pull data from application memory and take over active sessions belonging to logged-in customer service representatives.

Using that foothold, the group allegedly created large batches of fraudulent gift cards and delivered them to email accounts it controlled. The court filing cites one case in which 35 cards tied to the Staples breach were spent at a New Hampshire Target on Apple, Bose, and Powerbeats products within a single hour.

According to the filing, surveillance video showed four men making repeated purchases while cycling through gift cards on their phones. Workers at Target later told investigators the same men were well known there and appeared almost daily to make sizable Apple purchases.

Records from Target showed 3,850 gift cards worth about $141,000 were redeemed in 300 transactions at 85 stores across 18 states over two days.

Other retailers reported similar patterns. Sephora told investigators the group used about 330 gift cards worth $58,600 online across 1,500 transactions, while Lowe's reported 450 gift cards worth $226,000 redeemed online and in person at more than 22 locations.

More background

Authorities ultimately said 4,630 of the stolen gift cards were used, representing roughly $425,000, according to 404 Media. The outlet also said the Staples intrusion is connected to a retail theft case in which the group obtained more than $100 million in gift cards, citing a Justice Department press release.

The group shipped most of the stolen goods back to warehouses in China as part of a massive retail theft operation that repeatedly targeted local stores and workers to move new electronics and products into black-market channels.

What's being done?

Federal investigators mapped the scheme with help from retailers that shared redemption information. A Department of Justice press release stated three Chinese nationals were sentenced for their roles in the gift card fraud conspiracy.

Thomas Demeo, Acting Special Agent in Charge of the Internal Revenue Service Criminal Investigation Boston Field Office, said, "IRS-CI is committed to our continued collaboration with our law enforcement partners, both at home and abroad, to stop and deter anyone who seeks to profit off the hard work of U.S. citizens."

Get TCD's free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.