Staples hacked by Chinese crime ring to steal millions in gift cards

A Chinese organized crime group hacked the retail giant Staples to illicitly issue millions of dollars in gift cards. According to unsealed court documents and reports from 404 Media, the group exploited the company’s Nexus customer support system by using heap dump requests to hijack active sessions of customer service representatives.

By impersonating employees, the hackers manipulated order totals—in one instance changing a $200 gift card order to just one cent—and bypassed anti-fraud systems to deliver cards to controlled email addresses. In one reported incident, over 15,000 gift cards worth more than $5 million were fraudulently issued.

The stolen cards were used across the United States at major retailers including Target, Sephora, and Lowe’s to purchase high-end electronics and other goods, which were then shipped to China. Target reported that in just two days, criminals used 3,850 cards across 85 stores in 18 states, totaling approximately $141,000 in transactions.

In April 2025, three Chinese nationals were sentenced to prison terms ranging from 24 to 60 months for their roles in laundering the proceeds of these stolen cards. Authorities noted that such criminal organizations often use platforms like WeChat to coordinate the distribution of stolen card data in exchange for cryptocurrency.