404 Media: Chinese Crime Ring Hacked Staples Support System to Mint Over $5M in Gift Cards; DOJ Says Wider Network Topped $100M in Gift Cards
A Chinese organized crime group hacked into office-supply retailer Staples' internal customer-service system and fraudulently issued more than 15,000 gift cards worth over $5 million, then used the cards to buy electronics and other goods at retailers across the United States, shipping much of the merchandise back to China, according to an October 19 report by technology outlet 404 Media based on a recently unsealed Homeland Security Investigations (HSI) search warrant application. The court filing does not name the retailer; 404 Media identified it as Staples through its Massachusetts headquarters, gift-card fulfillment by Blackhawk Network, and the name of its internal support system, Nexus. Staples did not respond to 404 Media's requests for comment.
According to the filing, HSI first learned of the scheme in October 2023. The intruders reached the Nexus support system from outside the company, although Staples believed it was accessible only from internal computers. Through repeated heap-dump requests, which capture the data held in an application's memory, they hijacked the logged-in sessions of customer-service representatives and used those sessions to issue gift cards to email accounts they controlled. Investigators counted 4,630 of the cards redeemed, worth about $425,000: some 3,850 cards worth about $141,000 were used at 85 Target stores in 18 states in just two days; Sephora reported about 330 cards worth $58,600 redeemed across roughly 1,500 online transactions; and Lowe's reported about 450 cards worth $226,000 redeemed online and at more than 22 locations.
Case materials previously released by the U.S. Attorney's Office for the District of New Hampshire show the Staples intrusion was one part of a much larger operation. Organized criminal elements in China acquired well over $100 million in gift cards by hacking U.S. companies, tampering with physical gift cards, and running romance and elder fraud schemes targeting U.S. citizens, prosecutors said. The card data was sent through a Chinese messaging platform, in exchange for cryptocurrency, to cells of Chinese nationals in the United States, who spent the cards mainly on Apple products and other high-value electronics, consolidated the goods in warehouses, and shipped them to China, Hong Kong, or countries in Southeast Asia. The cells favored states with no sales tax, such as New Hampshire, to maximize profits.
Three Chinese nationals have been sentenced in federal court in connection with the conspiracy, the U.S. Attorney's Office said. Naxin Wu, 26, unlawfully residing in Nashua, received 33 months in prison; Mengying Jiang, 34, of Nashua, received 60 months; and Mingdong Chen, 28, unlawfully residing in Brooklyn, New York, received 24 months. Each also received one year of supervised release, each had pleaded guilty to conspiracy to commit wire fraud, and each faces deportation to China after completing the sentence. Prosecutors put the fraudulent gift-card amounts handled by the three at $1.4 million, $3 million, and $400,000, respectively. Acting U.S. Attorney Jay McCormack said the defendants played a critical role in laundering the proceeds of romance and other online scams. The investigation was led by HSI, IRS Criminal Investigation, the U.S. Postal Inspection Service, and the Concord Police Department, and the case was prosecuted by Assistant U.S. Attorney Alexander S. Chen.
Published by GSM · USA (original Chinese edition)
Photo: 美国一家 Staples 办公用品门店外景资料图。照片：Harrison Keely 摄，CC BY 4.0，经 Wikimedia Commons。 / A Staples office-supply store in the United States (file photo). Photo: Harrison Keely, CC BY 4.0, via Wikimedia Commons
