Hackers Use Dell and Staples Emails to Send Scams
Cybercriminals are embedding fraudulent instructions within legitimate purchase alerts to deceive retail customers.
Updated on Oct. 22, 2026 in Cybersecurity
Live Poll
Do you trust your ability to identify fake purchase alerts within legitimate retail emails?
Hackers have hijacked email systems belonging to Dell and Staples to distribute sophisticated phishing messages. These alerts notify recipients of expensive purchases they likely did not make, directing them to call attacker-controlled phone numbers.
Why it matters
By weaponizing automated order confirmation emails, attackers leverage the inherent trust customers place in major retailers to bypass traditional spam filters. This technique exploits the natural panic caused by surprise transaction notices, increasing the likelihood that targets will call the provided numbers to dispute the fake orders.
The scam involves the direct manipulation of automated retail notification systems to embed malicious instructions into legitimate order detail fields. This approach allows attackers to bypass standard security heuristics by utilizing the authenticated email infrastructure of recognized vendors.
The players
Dell
Dell is a multinational technology company that provides computer hardware and software solutions to individual consumers and enterprise businesses.
Staples
Staples is a major retail chain specializing in office supplies, technology products, and business services for consumers and companies.
The details
Recipients receive professional-looking notifications detailing high-cost purchases they did not authorize, prompting them to take immediate action. Attackers include a phone number within the message, intending for concerned customers to contact scammers who pose as support agents to extract sensitive information.
Timeline
October 22, 2026: The exploit targeting retail email systems was reported.
The Tech Race
This incident highlights an ongoing shift in phishing tactics away from obvious impersonation toward the exploitation of trusted, authenticated communication channels. It represents a departure from traditional fake-sender attacks, forcing a reevaluation of how retail order systems protect the data fields used in customer notifications.
Users should exercise extreme caution when receiving unexpected order notifications, even if the sender appears to be a legitimate major retailer. Always verify purchases directly through an official account dashboard rather than calling phone numbers listed in suspicious email alerts.
The takeaway
Always verify transaction alerts by logging into your official account portal rather than calling phone numbers found within unexpected emails. Treating every unsolicited confirmation with skepticism remains your best defense against sophisticated retail-based social engineering.
Further reading
Learn more about evolving digital threats in our Cybersecurity section.
Live Poll
Do you trust your ability to identify fake purchase alerts within legitimate retail emails?
