According to a search warrant application unsealed this month, a Chinese organized crime group hijacked customer-service sessions at a large office-supply retailer in 2023 and issued more than 15,000 gift cards worth over $5 million. The filing never names the company. 404 Media identified it as Staples on October 19, and the Staples gift card hack has since spread across tech and security coverage.
The case is a retail and fraud story, but the intrusion is three years old. Homeland Security Investigations first learned of the scheme in October 2023, when the company reported that its systems had issued more than 15,000 gift cards, according to TechSpot. The details stayed out of public view until the warrant was unsealed. Coverage so far relies on the filing as reported by 404 Media and others, not on an account from Staples itself.
How the Staples gift card hack unfolded
404 Media tied the filing to Staples using three details: the company’s Massachusetts headquarters, its use of Blackhawk Network for gift card fulfillment, and an internal customer-support system called Nexus, as Mezha reported. The filing says the company believed Nexus could only be reached from its internal computers. The hackers found a way in from outside.
The method relied on heap dump requests. A heap dump captures data held in an application’s memory. The attackers used what they pulled to take over active sessions belonging to customer-service representatives who were already logged in. With those sessions, the group issued gift cards and sent them to email accounts it controlled, according to Yahoo News.
Why a hijacked session is hard to spot
Nobody broke encryption or cracked a password here. The attackers abused a trusted internal tool that was reachable from outside, which made their activity look like the work of a legitimate employee, as Inc. reported. Aviv Nahum, CEO and co-founder of Above Security, put the problem bluntly in an interview with Inc. “Once you hijack a logged-in session, every action carries a real employee’s name and permissions.”
That is the core lesson for security teams. Audit logs record the employee’s identity, so fraudulent gift card issuance can look like routine work until someone compares volume, timing and destination against normal activity. A standard login check may never flag the session, because it was already authenticated when the attackers took it over. Compared with a stolen password, this kind of intrusion leaves fewer obvious traces for a defender to find.
Where the gift cards went
The cards were spent quickly. Target traced 35 of them to a single New Hampshire store, where they were used to buy Apple, Bose and Powerbeats products within an hour, according to Yahoo News. That speed suggests the group treated the cards as cash it intended to move before anyone noticed. Much of the merchandise was reportedly shipped to China, according to TechSpot and Dexerto.
Investigators have also traced about $425,000 in redemptions to the breach, according to RuntimeWire. The reporting does not explain the gap between that figure and the $5 million in face value. Investigators describe a pipeline, not a single hack: cards were generated, cashed out at big-box retailers and shipped overseas. That structure means the exposure reaches every retailer that accepts the cards, not only the company whose system was breached.
Which figures are confirmed and which are secondhand
| Figure | Reported amount | Where it comes from |
|---|---|---|
| Gift cards issued | More than 15,000 | Unsealed search warrant application, as reported by TechSpot and Inc. |
| Face value | More than $5 million | Same filing, as reported by TechSpot and Inc. |
| Redemptions traced to breach | About $425,000 | RuntimeWire |
| Single-store use | 35 cards at one Target in under an hour | Yahoo News |
| Wider scheme | More than $100 million | Dexerto and Mezha, citing prosecutors through secondary reporting |
The $100 million figure needs the most caution. It reaches readers through secondary reporting, and the primary filing behind it has not been publicly located. Treat it as a claim, not a settled total, until primary records are available.
What the breach says about retailers and internal tools
Retailers and any company running internal customer-support or gift card platforms face the most direct exposure. The lesson is simple to state and harder to implement. Internal-only tools need real network restrictions, and sessions need protections that limit what a stolen one can do.
This story echoes other recent USA 24 coverage. The Gheist campaign used stolen GitHub tokens to dump repository secrets, and a Tailworm report disclosed 11 unpatched Tailscale and headscale flaws. The common thread is access that looked authorized. The Staples case shows the cost when that access can issue gift cards worth real money.
The story has also moved beyond a single outlet. Hackaday and This Week in Security both flagged Staples in their weekly roundups, according to Hackaday and This Week in Security.
What to do if you hold Staples or retailer gift cards
The reporting does not say Staples customers’ personal data was taken, so the most likely risk for shoppers is financial. The steps below are general guidance, not drawn from the filings.
- Check your Staples account, gift card balances and recent order history for changes you did not make.
- Review the email addresses on your retailer accounts and look for any you do not recognize.
- Report gift card fraud to the Federal Trade Commission and to your state attorney general.
- If you spot unauthorized activity, contact the retailer and your card issuer.
Businesses should take a different set of steps:
- Test whether any internal support, admin or gift card tool can be reached from outside the corporate network.
- Restrict or remove endpoints that can produce memory dumps in production.
- Shorten session lifetimes and alert on bulk gift card issuance or sudden changes to account contact details.
What to watch next
Several questions remain open. Staples has not publicly confirmed the details, and it did not respond to requests for comment, according to Mezha. Nobody has confirmed whether Nexus has been fixed or whether the company changed its gift card controls. The reporting also does not say whether any arrests or charges have followed.
Related prosecutions have already moved forward. The FBI arrested another ShinyHunters suspect in the FBIjobs.gov breach case, a reminder that these investigations can move slowly and in stages.
The unsealed docket is the thing to watch. A full filing could confirm the $100 million figure, name defendants or clarify how long the access path stayed open. A statement from Staples would matter just as much, since it can say when Nexus was secured. The case also shows that a 2023 intrusion can resurface through court records years later, so companies should expect older incidents to return.
