Massive Chinese Crime Ring Used Staples Hack to Steal $425,000
A massive Chinese crime ring accessed Staples’ customer support system and used the intrusion to issue gift cards, according to court records reviewed by 404…
A massive Chinese crime ring used a breach of Staples’ customer support system to issue gift cards and buy electronics across the United States, according to court records reviewed by 404 Media. The operation used 4,630 cards worth around $425,000, with some merchandise shipped to China.
The case shows how access to an internal retail system could be turned into purchases across several national chains. Target, Sephora and Lowe’s provided investigators with records of gift cards redeemed in stores and online.
Hackers hijacked customer service sessions
Homeland Security Investigations received information in October 2023 from an office supply company that hackers had targeted it and issued more than 15,000 gift cards worth over $5 million, according to a search warrant application unsealed last week.
The application does not name the company. 404 Media identified it as Staples based on details in the document: the company was headquartered in Massachusetts, used Blackhawk Network to fulfill gift card orders and had an internal customer support system called Nexus. The publication also found a reference to Nexus on a former Staples executive’s LinkedIn profile. Staples did not respond to requests for comment.
According to the application, Staples believed Nexus could only be accessed from the company’s internal computers. Investigators said hackers found a way in from outside and made repeated “heap dump” requests, which captured data held in the application’s memory. They then used returned information to hijack sessions belonging to logged-in Staples customer service representatives and issue gift cards.
The cards went to email accounts controlled by the hackers. Gang members used many of them to buy electronics at retailers including Target. The scale meant the intrusion reached beyond Staples: investigators’ records describe cards being redeemed at stores in multiple states, as well as through online transactions.
Retailers traced hundreds of thousands of dollars
Target told investigators that 3,850 gift cards worth around $141,000 were used at 85 stores in 18 states over two days. The records counted 300 individual transactions. Target also found that 35 cards tied to the Staples hack were used at one store in New Hampshire to buy Apple, Bose and Powerbeats products in just one hour. Those purchases included cards from the hack and other sources, the application said.
Surveillance footage showed four men “appearing one after another, occasionally interacting with one another and the cashiers.” The application says M. Chen, X. Chen, Jiang and the UAM presented electronic Target gift cards on their phones until they had “exhausted” the cards available. Target employees later told investigators the men were familiar faces who came in “almost every day” to make large purchases of Apple products using gift cards.
Sephora told investigators the group redeemed around 330 gift cards worth $58,600 online across 1,500 transactions. Lowe’s reported that 450 cards totalling $226,000 were redeemed in person and online at more than 22 locations.
The figures describe a direct cost for retailers and show how stolen access could be converted into goods through ordinary checkout systems. The records say many electronics and other products were shipped back to China, while warehouses were used to hold merchandise. 404 Media reported that the case is connected to a previously announced prosecution of a retail theft ring. The gang ultimately used 4,630 hacked gift cards, totalling around $425,000.
Source: 404media.co
