Hackers Hijacked Staples' Support System for $5 Million in Gift Cards

A federal search warrant says about $425,000 of the hacked cards were spent at Target, Lowe's and Sephora.

Four men took turns at a Target register in New Hampshire, holding up their phones so a cashier could scan gift card after gift card.

In about an hour, 35 cards from a single hack went through that store. They paid for Apple, Bose and Powerbeats gear, mixed in with cards from other sources, according to a federal search warrant application unsealed last week. The hack hit an office supply company, the document says, and 404 Media reported Monday that the company is Staples.

The warrant doesn't name Staples. 404 Media matched it from the clues. The victim is based in Massachusetts and uses a company called Blackhawk Network to fill its gift card orders. It also runs an internal customer support system called Nexus, and 404 Media found that name on a former Staples executive's LinkedIn profile. Staples didn't respond to 404 Media's requests for comment.

Staples believed Nexus could only be reached from its own computers, the document says. The hackers got to it from outside anyway. Then they sent it a string of heap dump requests, which ask an app to hand over a snapshot of everything in its memory at that instant.

Those snapshots gave them enough to take over the sessions of customer service reps who were already logged in. Working from inside those sessions, the warrant says, they issued upward of 15,000 gift cards with a combined value above $5 million. The cards went to email accounts the hackers controlled.

Staples flagged the attack to Homeland Security Investigations in October 2023. By the warrant's count, most of that money never got spent. The group used 4,630 of the hacked cards, worth about $425,000, or less than a tenth of the total.

At Target, the cards turned up at 85 stores across 18 states. All of it happened inside two days. Lowe's took the biggest hit in dollars, about $226,000 across more than 22 locations and its website, and Sephora saw $58,600 redeemed online.

At the New Hampshire store, employees told investigators the four men "came into the store almost every day to make numerous large purchases of Apple products using gift cards," according to the warrant.

Prosecutors in New Hampshire had already laid out the playbook in April 2025. That's when they announced prison terms for three Chinese nationals in the gift card conspiracy that 404 Media ties to the Staples hack. The U.S. crews, prosecutors said, worked mostly in states with no sales tax, like New Hampshire, to squeeze more profit out of each card.

The prosecutors' release sketched the whole pipeline. Criminal groups in China collected well over $100 million in gift card data. They sold it over a Chinese messaging app, for cryptocurrency, to cells in the U.S. Those cells bought electronics, mostly Apple products, then stockpiled them in warehouses to ship to China, Hong Kong or Southeast Asia.

The three defendants each pleaded guilty to a wire fraud conspiracy charge and drew sentences of 24 to 60 months.

Hacking companies like Staples was only one way the ring stocked up. Besides corporate break-ins, prosecutors named two other supply lines: physical cards somebody had tampered with, and Americans targeted by romance scams and schemes against the elderly.

The Federal Trade Commission's gift card guidance comes down to three moves:

1. Before buying, look the card over on the rack. The protective stickers should be intact and untouched, and the PIN on the back shouldn't be showing. If something looks off, take a different card and show the bad one to a cashier or manager.
2. Photograph the card and the store receipt. Those numbers help with a report to the card company if the card goes missing or gets used in a fraud.
3. If the numbers already went to someone who asked for payment, call the card company right away, whenever it happened. Target's line is 1-800-544-2943. Ask for the money back, then file a report at ReportFraud.ftc.gov.

The commission's firmest line is about paying with them: it says no legitimate company or government office will ever ask to be paid in gift cards. Its rule fits in five words: "Gift cards are for gifts."

Source: 404media.co, retrieved October 19, 2026. Other sources: justice.gov, consumer.ftc.gov.