Hackers used access to Staples’ customer-support system to issue gift cards worth more than $5 million, according to a 404 Media report based on court records. The newly described breach shows how stolen staff sessions could turn an internal system into a route to hundreds of thousands of dollars in retail purchases.
Watch Desk analysis
What happened
404 Media says a search-warrant application unsealed last week describes how hackers accessed Staples’ Nexus customer-support system, which the company believed was available only from its internal computers. The report says the attackers used repeated “heap dump” requests to capture data in the application’s memory, then hijacked the sessions of logged-in customer-service representatives to issue gift cards.
The warrant application does not name Staples. 404 Media says it identified the retailer using details in the document, including its Massachusetts headquarters, its use of Blackhawk Network for gift-card fulfilment and the name of its support system. Staples did not respond to the publication’s request for comment.
The application says more than 15,000 gift cards worth over $5 million were issued. Investigators traced $425,000 across 4,630 cards redeemed at retailers including Target, Sephora and Lowe’s. Those figures describe cards investigators linked to the scheme, not the total value of all the group’s activity.
Why it matters
The reported route in was not a cash register or a payment processor, but a support system holding active staff sessions. If attackers can take over a logged-in employee’s access, they may be able to make fraudulent transactions look like ordinary work. The specific account comes from court records described by 404 Media; the application does not name Staples, and the retailer has not commented to the publication.
The case is connected to a wider gift-card fraud prosecution. The US Justice Department said last year that three Chinese nationals were sentenced for roles in a conspiracy involving more than $100 million in gift cards. That figure concerns the wider scheme, not the value of the Staples cards identified in the warrant application.
Our read
The useful security question is not simply whether a system is labelled “internal”, but whether it can be reached from outside and what a stolen staff session can do. The reported heap-dump and session-hijacking chain makes this a concrete warning for organisations whose support tools can issue money-like credits. The allegation and Staples identification remain attributed to 404 Media’s account of the court records, not a finding that the retailer has confirmed.
What to watch
- Whether further court filings identify the company and explain how the system was accessed.
- Whether Staples responds or describes changes to its support-system access controls.
- Whether investigators link more gift-card redemptions to the breach. 404 Media’s report
Discussion spark: When support staff can issue gift cards, should retailers prioritise preventing outside access to those systems, or limiting what a hijacked staff session can do?
Sources and evidence
- How a Massive Chinese Crime Ring Hacked Staples to Steal Millions (19 October 2026, 13:23 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.