How a $5M Staples Breach Fueled a $100M China Export Ring

A Chinese organized crime network extracted more than $100 million in gift cards from U.S. retailers by exploiting internal corporate software, using the stolen funds to purchase electronics and ship them overseas, according to federal court records and Justice Department sentencing announcements.

The operation turned American big-box stores into an untraceable supply chain for export-bound merchandise. Three Chinese nationals were sentenced to prison in April for their roles in the broader conspiracy, though the Justice Department did not identify the specific companies whose systems were breached in its public announcement.

A newly unsealed search warrant application details how the network penetrated Nexus, an internal customer-support application used by Staples. The retailer was identified by 404 Media through its Massachusetts headquarters, its use of Blackhawk Network for gift card fulfillment, and references to Nexus on a former executive’s LinkedIn profile. Staples did not respond to requests for comment from 404 Media.

Investigators say the attackers reached Nexus from outside the company’s network. They executed multiple heap-dump requests, which capture data held in an application’s memory at a given moment. This allowed the group to hijack active sessions belonging to logged-in customer-service representatives. Using those credentials, they issued more than 15,000 gift cards worth over $5 million. How the hackers initially gained outside access to the system remains unknown, the court document states.

Homeland Security Investigations began tracking the scheme in October 2023 after the company reported the fraudulent issuances. By then, the cards had already been distributed to email addresses controlled by the network.

Participants displayed the digital cards on mobile phones for cashiers to scan. Surveillance footage reviewed by investigators showed four men moving through checkout counters sequentially at a New Hampshire Target store. Within one hour, they spent 35 gift cards linked to the breach on Apple, Bose, and Powerbeats products, sometimes combining them with cards obtained from other sources. Target employees told investigators the same individuals visited almost daily to buy large quantities of Apple products.

Target traced 3,850 cards tied to the intrusion, worth approximately $141,000, across 300 transactions in 85 stores spanning 18 states over a two-day period.

Other retailers absorbed significant losses. Sephora reported about 330 cards worth $58,600 redeemed online across 1,500 transactions. Lowe’s identified 450 cards totaling $226,000 used both online and in person at more than 22 locations.

In total, the network redeemed about 4,630 cards generated from the breach, valued at roughly $425,000. That figure represents only a fraction of the more than $5 million originally issued through the compromised Nexus system.

The stolen goods were routed through warehouses before being shipped to China, completing a cycle that converted unauthorized software access into physical inventory. The $100 million total attributed to the wider ring encompasses attacks on multiple U.S. businesses beyond the single retailer detailed in the warrant application.