How a Chinese Crime Ring Hacked Staples to Steal Millions

A major Chinese organized crime group hacked the systems of retail giant Staples, used that access to fraudulently issue millions of dollars worth of gift cards for chains like Target and Sephora, and then went on a nationwide shopping spree. Much of the electronics and other goods they bought were shipped back to China as part of a large retail theft operation, 404 Media reports, citing court records.

According to the outlet, in October 2023 Homeland Security Investigations (HSI) received a report from an office supply company saying hackers had targeted it and issued more than 15,000 gift cards worth over $5 million. A search warrant application unsealed last week does not name the company, but 404 Media identified it as Staples based on several clues: headquarters in Massachusetts, the use of Blackhawk Network to fulfill gift card orders, and an internal support system called Nexus. Staples did not respond to requests for comment.

A breach through memory dumps

Staples believed Nexus was only accessible from the company's internal computers, but the hackers found a way to reach it from the outside. They performed several heap dump requests — a method of capturing all the data held in an app's memory at a given moment. Using the returned information, they hijacked the sessions of logged-in Staples customer service representatives and issued the gift cards.

The cards were sent to email accounts the gang controlled, after which its members spent them on electronics at stores like Target. In one case, at a Target in New Hampshire, 35 cards sourced from the Staples hack were used in a single hour to buy Apple, Bose, and Powerbeats products. Surveillance footage showed four men "appearing one after another," presenting cashiers with phones displaying electronic cards and cycling through them until they were exhausted. Store staff later said the men were well known to them, coming in almost daily to make large purchases of Apple products.

The scale of the scheme

Target gave investigators data showing the crooks used 3,850 cards worth about $141,000 across 85 stores in 18 states over two days — 300 transactions in all. Sephora reported roughly 330 cards worth $58,600 redeemed online across 1,500 transactions. Lowe's had 450 cards totaling $226,000 redeemed. In total, the gang used 4,630 of the hacked cards, amounting to around $425,000.

The case is tied to a previously announced prosecution of a retail theft ring. Last April, the U.S. Department of Justice announced the sentencing of three Chinese nationals for their roles in the gift card fraud conspiracy. The network, however, was larger in scope: according to the DOJ, the group acquired more than $100 million worth of gift cards. That press release mentioned the hacking of U.S. companies but did not name Staples.

Source: 404 Media