According to recently unsealed court documents, Chinese hackers once altered an order for 2,000 Staples electronic gift cards, each valued at $200, changing the price to just one cent per card and inputting invalid gift card numbers as payment information. With a total face value of $400,000, these gift card orders bypassed payment and anti-fraud interception, successfully completing delivery without actual payment.
404 Media, an independent digital technology news media, reported on Monday (Oct. 19) that a Chinese organized crime group hacked into the system of retail giant Staples, illegitimately issuing millions of dollars worth of gift cards that could be used at stores like Target and Sephora. Subsequently, the group went on a shopping spree across the United States, shipping a large quantity of stolen electronics and other goods back to China as part of a large-scale retail theft operation.
According to a search warrant unsealed last week, in October 2023, the U.S. Homeland Security Investigations (HSI) received a report from an office supply company stating that they had been attacked by hackers and over 15,000 gift cards, totaling over $5 million, had been issued.
While the document did not specify which company it was, 404 Media confirmed through multiple clues that it was the office supplies company Staples. The media was founded in August 2023 by four senior journalists formerly from the renowned tech media Vice/Motherboard.
Staples, headquartered in Massachusetts, used a company called Blackhawk Network to process gift card orders and the hacked company had an internal customer support system named Nexus.
According to court documents, only internal computers of the company could access the Nexus system, but the hackers found a way to access it externally. The documents stated that the hackers executed multiple heap dump requests, a method of capturing all data in the memory of an application at a specific time. Using the returned data, the hackers then hijacked conversations of logged-in Staples customer service representatives, subsequently issuing a large number of gift cards.
For example, in an order on October 18, 2023, 2,000 Staples electronic gift cards sold at Target, each valued at $200, were ordered. The criminals altered the price, changing the selling price of each gift card to $0.01, resulting in a total order amount of $20.
What’s more, the criminals used gift cards to pay for this $20 transaction, but the provided gift card numbers were invalid.
These altered orders circumvented “waiting for payment” and other anti-fraud systems to be shipped. These electronic gift cards were then sent to multiple email accounts designated by the hackers.
Subsequently, the group’s members visited stores like Target, using these gift cards to purchase electronics. For instance, Target found that within just an hour, 35 gift cards from the Staples hack were used at a Target store in New Hampshire to buy products from brands like Apple, Bose, and Powerbeats. The footage from surveillance cameras showed that four men visited the store almost every day, interacting with each other and cashiers.
Court documents revealed that an unidentified individual provided the card numbers and PIN codes of these 35 gift cards to the involved individuals through the Chinese social media platform “WeChat,” with communication in Chinese shown in related chat screenshots.
Data provided by Target to investigators showed that on two days, these fraudsters used 3,850 gift cards at 85 different Target stores in 18 states, with a total value of about $141,000. The documents indicated that this involved 300 separate transactions.
Furthermore, beauty chain store Sephora informed investigators that the fraudulent group redeemed approximately 330 gift cards online, totaling $58,600 in value across 1,500 transactions. Similarly, home improvement chain store Lowe’s discovered 450 fraudulent gift cards, valued at $226,000, which were exchanged online and at brick-and-mortar locations in over 22 Lowe’s stores.
So far, the group has used 4,630 stolen gift cards, causing approximately $425,000 in product losses.
Such gift card theft incidents are rampant in the United States. The Department of Justice has pointed out that the amount defrauded by Chinese criminal groups through gift card fraud in the U.S. has exceeded $100 million.
In April 2025, a New Hampshire court sentenced three Chinese individuals involved in a meticulously planned gift card fraud case. The three defendants were sentenced to 24 to 60 months in prison and different penalties, to be deported to China after serving their sentences.
Thomas Demeo, Acting Special Agent in Charge of the Boston office of the Criminal Investigation Division of the Internal Revenue Service, stated that these three defendants were integral to this international criminal scheme, responsible for laundering the illicit funds obtained by Chinese hackers and fraudsters in the U.S.
According to a statement from the Department of Justice at that time, organized crime groups in China had acquired gift cards worth over $100 million through various fraudulent means. For example, they targeted U.S. citizens by infiltrating American companies, tampering with physical gift cards, and using tactics like romance scams and elderly fraud to obtain gift card data. Subsequently, criminals in China sent this gift card data to multiple Chinese gangs operating in the U.S. through an instant messaging platform within China, in exchange for cryptocurrency.
The statement noted that once the gangs in the U.S. received the gift card data, they used it to purchase high-value electronic products, primarily Apple products. After acquiring Apple products, the group members stockpiled these electronics in warehouses before shipping them to mainland China, Hong Kong, or Southeast Asian countries. To maximize profits, these groups mainly operated in states like New Hampshire where sales tax was exempt.