GoKawiilChinese hacking ring stole $5M+ in gift cards via Staples internal system in 2023
A Chinese crime ring breached Staples' internal customer support tool, Nexus, and used heap dump requests to hijack logged-in employee sessions, enabling them to issue more than 15,000 fraudulent gift cards worth over $5 million. The cards were then quickly spent by 'runners' at retailers including Target, Sephora and Lowe's before they could be canceled. The breach, reported to Homeland Security Investigations in October 2023, only became public after a related search warrant was unsealed last week.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how a single compromised internal tool can cascade into losses across unrelated retailers, since stolen gift cards function as cash-equivalent instruments once issued. It also suggests that assumptions about network isolation—Staples reportedly believed Nexus was inaccessible externally—can be dangerously wrong, which may prompt other retailers to audit similar internal systems. The delayed disclosure raises questions about how long companies can keep breaches quiet before legal proceedings force transparency.
- Hackers exploited Staples' internal Nexus system using heap dump requests to hijack employee sessions.
- More than 15,000 gift cards worth over $5 million were issued and spent at retailers like Target, Sephora and Lowe's before cancellation.
- The 2023 breach only came to light after a related search warrant was unsealed last week, per court records reviewed by 404 Media.
Source: tomshardware.com — Oliver Haslam, 2026-10-20
Published there as: “Chinese crime ring steals more than $5 million in gift cards from Staples customer service”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.