Chinese Cybercriminals Exploited Staples Gift Card System to Steal $5 Million
A breach of Staples' internal gift card platform enabled a crime ring to generate over 15,000 fraudulent cards, which were then used to purchase electronics at major retailers.
Thieves with ties to China infiltrated Staples' gift card infrastructure, making off with more than $5 million in cards redeemable at chains including Target, Sephora, and Lowe's. The perpetrators leveraged their access to an internal system called Nexus to generate in excess of 15,000 fraudulent cards, which they subsequently deployed to acquire high-end technology products across multiple retail locations.
The intrusion occurred in 2023, though it remained undisclosed until recently. According to reporting by 404 Media, which reviewed unsealed court documents, Homeland Security Investigations received notification of the breach in October 2023. The search warrant that exposed the incident was unsealed last week.
While the warrant does not explicitly identify Staples as the victim, 404 Media determined the company's involvement through corroborating details. The targeted organization is based in Massachusetts, relies on Blackhawk Networks to process gift card fulfillment, and operates a customer service platform branded as Nexus. The outlet also noted that references to Nexus appear in the professional profiles of former Staples executives.