Chinese Crime Ring Allegedly Hacked Staples to Mint $5 Million in Gift Cards

A group of hackers allegedly exploited a major retailer’s customer support system to fraudulently generate more than 15,000 gift cards worth over $5 million, then used some of them to buy electronics that were subsequently shipped overseas. The victim was Staples, reports 404 Media, which identified the retailer through clues in a court filing that does not name the company. According to the underlying court documents, investigators learned of the hack in October 2023, after the retailer reported that hackers had issued more than 15,000 gift cards worth approximately $5 million. The incident exposed a weakness in a system that the company believed could only be accessed from its internal network. The hackers allegedly found a way to access an internal customer support system, called Nexus, and used repeated “heap dump” requests to capture information stored in the application’s memory. That information helped them hijack or mimic sessions belonging to logged-in customer service representatives, allowing them to create fraudulent gift card orders. Although the company’s fraud detection system, Kount, flagged and declined some suspicious orders, investigators found that plenty of them were still marked for fulfillment. In one example described in the filing, an order for 2,000 Target gift cards, each carrying a $200 balance, was manipulated so that the cards cost just $0.01 apiece. That reduced the cost for the attackers from $400,000 to $20. The order listed an invalid gift card number as payment, even though the retailer did not allow customers to buy gift cards with other gift cards. However, payment and fraud holds were bypassed, and the gift cards were sent to email accounts controlled by the outside parties. The retailers associated with the fraudulent gift cards generated by the hackers included Target, Lowe’s, and Sephora. The group then used them to buy goods, including Apple products, via both physical stores and online shops. Roughly $425,000 in Gift Cards Were Redeemed Investigators traced approximately 4,630 gift cards worth around $425,000 to purchases made with cards generated through the Staples hack. Target told investigators that approximately 3,850 cards worth $141,000 were redeemed in 300 transactions across 85 stores in 18 states over two days. Sephora identified roughly 330 cards worth $58,600 that were used online across approximately 1,500 transactions. And Lowe’s reported about 450 cards worth $226,000 redeemed online and in person at more than 22 locations. At a Target in Salem, New Hampshire, 35 gift cards linked to the hack had a combined value of $7,000, and the purchases included approximately 38 Apple, Bose, and Powerbeats products. The transactions totaled $12,356.65, as the purchases also involved gift cards from other sources (more on that later). Credit: U.S. Department of Justice Surveillance footage showed four men arriving one after another and presenting gift cards displayed on their phones. After a cashier scanned a card, the men would check their phones and present another. They continued until they had exhausted the gift cards available to them. Target employees told investigators that the men were familiar faces who came to the store almost daily to make large purchases of Apple products using gift cards. When the items they wanted were unavailable, they allegedly bought other expensive merchandise and returned it for new gift cards, allowing them to transfer the balances. Three of the men were identified as Mingdong Chen, Mengying Jiang, and Xiang Zhong Chen. A Grander Scheme Worth More Than $100 Million The alleged Staples breach is part of a much larger issue related to organized online crime based out of China. According to the Department of Justice, organized criminal groups in China obtained well over $100 million in gift cards through a combination of hacking U.S. companies, tampering with physical gift cards, and scams targeting Americans, including infamous “pig butchering” schemes, which themselves are associated with billions of dollars worth of fraud. Gift card information was allegedly passed to cells of Chinese nationals operating in the United States through Chinese messaging app WeChat in exchange for crypto. The U.S.-based groups used the cards to buy high-value electronics, mainly Apple products, which were gathered in warehouses and shipped to China, Hong Kong, and Southeast Asia. Operating in states without sales tax, such as New Hampshire, helped maximize profits. In December 2023, police encountered the aforementioned Mingdong Chen at a Walmart in New Hampshire, where he had iPads in their original packaging in a white Mercedes alongside a Target bag. Chen said he received gift card numbers from a boss he knew through WeChat, used them to buy electronics, and suspected the cards were stolen. Incredibly, Chen said he was paid just $10 per device. After buying the merchandise, he would package it and leave it outside a warehouse or office. Someone else would collect and count the goods, and Chen would receive cash the next day. The electronics were then sent back to New York or China. A search of an apartment shared by Jiang and Naxin Wu in January 2024 turned up a laptop running a program that appeared to enter or receive gift card numbers, Apple gift cards, transaction notebooks, approximately $30,000 in cash, and large quantities of Apple products. Investigators found 35 iPhones in a bedroom closet and another 24 hidden in a bathroom vanity. A UPS driver who arrived with 15 packages of iPhones directly from Apple told investigators he made about four deliveries a week to the residence, mostly involving Apple products. The Justice Department said Wu was responsible for $1.4 million in fraudulent gift cards, Jiang for $3 million, and Chen for $400,000. Investigators also searched a warehouse in Salem operated by Jin Bin Ren, where they found more than 7,000 electronic items in original packaging, including thousands of Apple products, along with printers, computers, gaming consoles, headphones, receipts, shipping labels addressed to China, and approximately $10,000 in cash. Ren told investigators that his business received merchandise and forwarded it to China. He said customers communicated through WeChat and paid with cash or Chinese bank transfers. After the warehouse search, Ren booked a one-way flight from Boston to Seoul and boarded the plane before getting off. He later booked a flight from New York to Hong Kong and left the country, according to the court documents.