Chinese Crime Ring Hacks Staples Customer System

A criminal group exploited an internal system in 2023 to generate and spend millions of dollars in fraudulent retail gift cards.

Updated on Oct. 20, 2026 in Financial Crime

Bold flat-color editorial illustration showing a navy monolith pierced by a deep-red crystalline shard, representing a digital security breach. — A sophisticated cybercrime ring exploited internal retail systems in 2023, siphoning over $5 million through thousands of fraudulent gift cards. AI Illustration. Upload story photo >

Live Poll

Do you trust that major retailers are doing enough to secure gift cards from digital theft?

In 2023, a Chinese crime ring gained unauthorized access to the Staples Nexus customer service system to issue over 15,000 fraudulent gift cards. The operation resulted in more than $5 million in stolen retail value before the cards were deactivated.

Why it matters

The security breach highlights vulnerabilities in internal corporate systems that remain accessible from outside private networks. This specific hack was part of a broader criminal network responsible for over $100 million in gift card fraud across the United States.

Three Chinese nationals involved in the fraud conspiracy were sentenced in April 2026. Homeland Security Investigations was officially notified of the hack in October 2023, and a search warrant was subsequently unsealed in October 2026.

The players

Staples

This Massachusetts-based office supply retail company was the primary target of the customer service system breach.

Homeland Security Investigations

This federal law enforcement agency is the primary investigative body responsible for addressing cross-border financial crimes.

Target

This national retail corporation reported thousands of fraudulent gift cards used at its store locations.

Lowe's

This home improvement retail chain sustained hundreds of thousands of dollars in losses from the fraudulent gift card activity.

Sephora

This beauty retail company was among the merchants impacted by the fraudulent gift card scheme.

The details

Hackers hijacked active sessions of customer service employees and performed heap dump requests to scrape memory data from the Staples Nexus system. The stolen gift cards were used at multiple retailers, including $140,000 at Target across 85 locations, $226,000 at Lowe's, and $58,600 at Sephora.

The Staples system hack occurred in 2023.
Homeland Security Investigations received notification of the hack in October 2023.
Three Chinese nationals were sentenced for gift card fraud in April 2026.
A search warrant related to the case was unsealed in October 2026.

Legal Context

This case follows a pattern of high-value digital theft linked to global crime groups, as established by the $2 billion in losses linked to a Chinese phishing service. Authorities continue to grapple with international cybercrime networks that leverage internal corporate infrastructure to execute large-scale financial fraud.

Retailers have increased monitoring for gift card fraud at point-of-sale systems, which may lead to stricter verification processes for customers using gift cards. Consumers should remain cautious when purchasing gift cards from secondary or unauthorized sources due to the prevalence of these fraudulent programs.

The takeaway

Large retailers are increasingly vulnerable to credential hijacking that bypasses internal network security. Maintaining strict oversight of employee session management and system access permissions is essential to preventing mass gift card theft.