Hackers hijacked customer service sessions at American retailer Staples and used them to issue over 15,000 gift cards worth over $5 million. Investigators link the breach to the activities of Chinese criminal groups: they shipped a significant portion of the purchased goods to China.
Hackers hijacked customer service sessions at American retailer Staples and used them to issue over 15,000 gift cards worth over $5 million. Investigators link the breach to the activities of Chinese criminal groups: they shipped a significant portion of the purchased goods to China.
The attackers obtained session data from the memory of an internal Nexus support program, which the company believed should only be accessible from its own computers. Although the company was not named in the court document, 404 Media identified it by its headquarters in Massachusetts, the name of the Nexus program, and its use of the Blackhawk Network service to fulfill card orders, TechSpot reports .
The hackers were able to access Nexus from outside the corporate network and sent multiple memory dump requests. The information they obtained allowed them to intercept sessions of already logged-in support staff, then issue gift cards and send them to controlled email addresses. In October 2023, the company reported to law enforcement that more than 15,000 cards had been fraudulently issued.
Having received the cards in their mail, the gang members could simply show them on their phone screens to be scanned at checkouts. The investigation linked this hack to the activities of an organized gang from China, which purchased electronics and other goods, most of which were then sent to the PRC.
The scale of the stolen gift cards was truly impressive. In particular, Target recorded the use of 3,850 cards worth about $141,000 in 300 transactions, covering 85 stores in 18 states in just two days. For example, at one store in New Hampshire, four men used 35 cards in just one hour to purchase Apple, Bose and Powerbeats products, and employees noted that they came to pick up the equipment almost every day. At Sephora, about 330 cards worth $58,600 were redeemed through 1,500 online transactions. Meanwhile, at Lowe's, attackers used 450 cards for a total of $226,000 both online and in more than 22 physical locations.
In total, the attackers managed to pay off about 4,630 cards out of more than $5 million issued, for a total of about $425,000.
The heist was part of a larger gift card scheme in which stolen assets were first stored in warehouses and then shipped to China. In April, the U.S. Department of Justice announced prison sentences for three Chinese nationals involved in the scheme, although the statement did not specifically name Staples.
