Hackers got into Staples’ internal customer-service system from outside the company. There they took over the logged-in sessions of its support agents and used them to issue more than 15,000 gift cards worth over $5 million that nobody paid for, a figure prosecutors repeated in a later court filing. The cards went to email accounts the hackers controlled.
A crew then spent 4,630 of those cards, about $425,000, at Target, Sephora and Lowe’s, and electronics bought by the wider ring were shipped to China. The source is a Homeland Security Investigations search warrant application unsealed last week. 404 Media identified it as Staples from three clues: a Massachusetts headquarters, gift-card orders filled by an outside company called Blackhawk Network, and an internal support tool called Nexus that appears on a former Staples executive’s LinkedIn profile. Staples did not respond to 404 Media.
How hijacked sessions became 15,000 gift cards
The filing says Staples believed Nexus could only be reached from the company’s own computers. The hackers reached it from the outside.
Once in, they ran repeated heap dump requests. A heap dump makes an application hand over a snapshot of everything it is holding in memory at that moment. In Nexus’s case, that included the session data of customer-service representatives who were logged in. With that data, the hackers could hijack those sessions and issue the cards.
Three separate safeguards had to fail for that to work:
- The perimeter: a tool Staples thought was internal-only was reachable from the internet.
- Memory exposure: the system would dump live session data to whoever asked.
- Issuance without payment: a representative’s session could create gift cards with no money behind them.
As far as Nexus was concerned, the hackers were Staples’ own support staff.
The $5 million figure is what was issued. Prosecutors’ filing in a related case, as reported by The Epoch Times, says the company canceled most of the cards, but that criminals still redeemed more than 4,600 of them, about $425,000, “within 24 hours of the cyberattack.” That works out to about 8.5 cents of every dollar issued. It was not fast enough, and the spending that got through landed on other retailers’ shelves.
As far as Nexus was concerned, the hackers were Staples’ own support staff.
$425,000 spent at Target, Sephora and Lowe’s
The retailers handed investigators their own redemption data, according to 404 Media’s reading of the filing. Target’s share alone was spread over two days:
| Retailer | Hacked Staples cards redeemed |
|---|---|
| Target | 3,850 cards, about $141,000, in 300 transactions at 85 stores in 18 states over two days |
| Sephora | About 330 cards, $58,600, online across 1,500 transactions |
| Lowe’s | 450 cards, $226,000, in person and online at more than 22 locations |
| Total | 4,630 cards, about $425,000 |
At a Target in New Hampshire, 35 of the hacked cards, mixed with cards from other sources, went on Apple, Bose and Powerbeats products in a single hour. Surveillance footage showed four men “appearing one after another.” The warrant application identifies three of them by surname and the fourth only as “the UAM,” and describes the routine:
“M. CHEN, X. CHEN, JIANG, and the UAM each presented their cell phones to the Target cashier allowing the cashier to scan the electronic Target gift card displayed on their respective cell phones. After an electronic gift card was scanned, all four would use their phone, appearing to access another electronic gift card and presenting it to the cashier to be scanned.”
They kept going until the cards on their phones were “exhausted.” Store staff knew them. The men “came into the store almost every day to make numerous large purchases of Apple products using gift cards,” the document says.
The hauls were not small. On October 19, 2023, suspects bought $12,356.65 of electronics at a single Target. Electronics from the scheme went to a warehouse in Salem, New Hampshire, where investigators found more than 7,000 Apple products worth $8 million. Prosecutors say the conspiracy made use of New Hampshire’s lack of sales tax, per The Epoch Times. From Salem the goods were reshipped to China, with WeChat and cryptocurrency used to coordinate and pay, a route the IRS sentencing release also describes.
On July 22, 2026, the Justice Department announced that Jinbin Ren, 38, of Lynnfield, Massachusetts, the alleged operator of that warehouse, had been indicted for conspiracy to commit wire fraud. The charge carries up to 20 years.
Three co-conspirators were sentenced in April 2025, each term tied to the value of fraudulent cards that person handled, according to IRS Criminal Investigation:
- Mengying Jiang: 60 months, for $3 million in cards
- Naxin Wu: 33 months, for $1.4 million
- Mingdong Chen: 24 months, for $400,000
All three are to be deported to China after serving their sentences. Chen and Jiang are two of the surnames in the warrant’s account of the New Hampshire Target.
The DOJ put the whole network’s haul at more than $100 million in gift cards, a figure the IRS release repeats. Thomas Demeo, Acting Special Agent in Charge of IRS Criminal Investigation’s Boston Field Office, described the division of labour at the time:
“The defendants acted as an integral cog of this international scheme by monetizing the ill-gotten gains obtained by Chinese hackers and scammers that victimized U.S. businesses and the citizens of the United States.”
Hackers made the cards. This crew turned them into Apple products.
Staples’ gift-card desk has been exploited before
In 2017, Brooklyn prosecutors charged Rosemarie and Tashana Barnett, a mother and daughter, with doing the same thing by phone. Between December 2014 and September 2016 they called Staples customer service thousands of times, sometimes posing as managers. They got representatives to skip payment and release more than 700 e-gift cards worth over $250,000, which they spent at Target, Nordstrom and other stores.
Set the two cases side by side and the weak point is the same. In 2016, a Staples support agent could be talked into releasing gift cards without payment. In 2023, six years after Brooklyn prosecutors charged that scheme, a support agent’s session could still issue cards with no payment behind them. The hackers simply took the session instead of persuading the person. Same desk, same weakness, and in both cases the cards ended up at Target.
The prosecution is still running. Prosecutors date the conspiracy from September 2021 to January 2024, and Ren’s charge is pending. Everyone in court so far spent the cards or stored the goods; no hacker has been named or charged.
Further Reading
- How a Massive Chinese Crime Ring Hacked Staples to Steal Millions, 404 Media’s report from the unsealed HSI warrant application, with per-retailer redemption figures.
- Chinese National Indicted on Federal Charge in Gift Card Fraud Case, The Epoch Times on prosecutors’ filing in the Jinbin Ren case, including the canceled cards.
- Chinese National Indicted for Role in Gift Card Fraud Conspiracy, Justice Department release on Ren’s indictment and the Salem warehouse.
- New indictment in gift card conspiracy, Eagle Tribune on the $8 million in Apple products and the search dates.
- Yahoo News report on the hackers behind the Staples support-system breach, October 2026 coverage noting the hackers remain unidentified.
- Chinese nationals sentenced to federal prison for participating in a fraudulent gift card conspiracy, IRS Criminal Investigation release on the three April 2025 sentences and the amounts behind them.
- Chinese Nationals Sentenced to Federal Prison for Participating in a Fraudulent Gift Card Conspiracy, U.S. Attorney’s Office for New Hampshire on the sentences and the $100 million network total.
- Mother and Daughter Indicted for Stealing Over $250,000 From Staples, Brooklyn District Attorney’s 2017 announcement of the earlier Staples e-gift card case.