A Homeland Security Investigations search warrant application unsealed last week, reported by 404 Media on 19 October, sets out how a Chinese organised-crime ring turned Staples' own customer-service system into a gift-card factory. The document does not name the company but 404 Media matched it to Staples on three identifying features: a Massachusetts headquarters, gift-card orders filled by Blackhawk Network, and an internal support tool called Nexus. Staples believed Nexus was reachable only from its internal computers, but hackers reached it from outside and ran repeated heap-dump requests, which returned snapshots of the app's memory — including the live session data of logged-in customer-service representatives. Hijacking those sessions, they issued more than 15,000 gift cards worth over US$5 million and emailed them to accounts they controlled. The gang redeemed 4,630 of them, about US$425,000: 3,850 cards worth roughly US$141,000 at 85 Target stores in 18 states in two days, about 330 cards worth US$58,600 at Sephora online across 1,500 transactions, and 450 cards worth US$226,000 at more than 22 Lowe's locations, with electronics shipped to China. The Justice Department says the wider ring acquired more than US$100 million in gift cards and sentenced three Chinese nationals in April 2026. Why it matters: three safeguards failed together — an internal-only tool was internet-reachable, it leaked live sessions on demand, and a session could issue cards with no payment behind them.

• Source article