Connexion
How a Massive Chinese Crime Ring Hacked Staples to Steal Millions
A Chinese organized crime hacked into retail giant Staples, used that access to fraudulently issue millions of dollars worth of gift cards for stores like Target and Sephora, then went on a nationwide shopping spree, shipping many of the stolen electronics and other products back to China as part of a massive retail theft operation, 404 Media has learned.
The finding, based on a review of court records, reveals the scale at which some organized crime groups are fleecing U.S. retailers, with entire warehouses dedicated to housing the merchandise. The hack of Staples, which has not been previously reported, signals just how sophisticated some of these operations have become.
In October 2023, Homeland Security Investigations (HSI) received information from an office supply company, saying that hackers had targeted the company and issued more than 15,000 gift cards worth over $5 million, according to a search warrant application unsealed last week. The document does not name the company, but 404 Media determined it was Staples based on various clues: the document says the victim company is headquartered in Massachusetts; uses a company called Blackhawk Network to fulfill its giftcard orders; and the hacked company has an internal customer support system called Nexus. All of those identifying features match Staples, and 404 Media found a reference to Nexus on a former Staple’s executive’s LinkedIn profile.
Staples did not respond to requests for comment.
Screenshots from the search warrant application.
The document says Staples believed Nexus was only accessible to the company’s internal computers, but that the hackers found a way to access it from the outside. The hackers performed multiple heap dump requests, which is a way to capture all of the data held in an app’s memory at a particular point in time, according to the document. Using the returned information, the hackers were then able to hijack the sessions of logged in Staples customer service representatives to then issue the massive wave of gift cards, it adds.
The hackers sent the giftcards to various email accounts they controlled. After this, members of the gang went and spent many of the gift cards on electronics at stores like Target. In one example, Target found 35 of the gift cards sourced from the Staples hack were used at a Target in New Hampshire for Apple, Bose, and Powerbeats products in just one hour. Those purchases included gift cards from the hack and other sources too, according to the document. Surveillance footage showed four men “appearing one after another, occasionally interacting with one another and the cashiers.”
“M. CHEN, X. CHEN, JIANG, and the UAM each presented their cell phones to the Target cashier allowing the cashier to scan the electronic Target gift card displayed on their respective cell phones. After an electronic gift card was scanned, all four would use their phone, appearing to access another electronic gift card and presenting it to the cashier to be scanned,” the document says. The men did this until they had “exhausted” all of the gift cards available on their phones, and Target employees later said the four men were well known to staff at the store. They “came into the store almost every day to make numerous large purchases of Apple products using gift cards,” the document says.
Target gave data to investigators showing, for example, the crooks used 3,850 giftcards, worth around $141,000, at 85 different Target stores in 18 states across two days. That encompassed 300 individual transactions, according to the document. Sephora told investigators the gang redeemed around 330 giftcards, worth $58,600, online across 1,500 transactions. Lowe’s, meanwhile, had 450 giftcards, totalling $226,000, redeemed in person and online at more than 22 Lowe’s locations.
Ultimately, the gang was able to use 4,630 of the hacked giftcards, totalling to around $425,000.
The hack is related to a previously announced prosecution of a retail theft ring. Last April, the Department of Justice announced three Chinese nationals were sentenced for their roles in the gift card fraud conspiracy. While the newly unsealed document reveals the hack of Staples, the ring was even bigger in scope than the document suggests. The group acquired more than $100 million worth of gift cards, according to the press release.
That press release mentioned the hacking of U.S. companies, but did not name Staples. “The defendants acted as an integral cog of this international scheme by monetizing the ill-gotten gains obtained by Chinese hackers and scammers that victimized U.S. businesses and the citizens of the United States. IRS-CI is committed to our continued collaboration with our law enforcement partners, both at home and abroad, to stop and deter anyone who seeks to profit off the hard work of U.S. citizens,” Thomas Demeo, Acting Special Agent in Charge of the Internal Revenue Service Criminal Investigation, Boston Field Office, said at the time.
