Newly unsealed court records describe a sophisticated gift-card fraud operation that began with a breach of Staples' internal customer-service tool, Nexus. According to 404 Media, hackers used heap dump requests to capture data from the app's memory and hijack the sessions of logged-in Staples representatives, allowing them to issue thousands of gift cards and send them to email accounts they controlled.
Spending followed quickly. Target told investigators that 3,850 of the hacked cards, worth around $141,000, were used at 85 stores in 18 states over two days. In one hour at a New Hampshire Target, 35 cards bought Apple, Bose, and Powerbeats products. Sephora and Lowe's also reported redemptions, and investigators found that about 4,630 of the cards were ultimately used for roughly $425,000 in merchandise.
The Staples hack was not named in an earlier criminal case. Last April, three Chinese nationals were sentenced for roles in a gift-card fraud conspiracy, and prosecutors said the larger operation acquired more than $100 million worth of gift cards. 404 Media identified Staples as the unnamed victim company based on details in the warrant application, including its Massachusetts headquarters and use of the Blackhawk Network. Staples did not respond to requests for comment.