A group of hackers allegedly exploited a major retailer’s customer support system to fraudulently generate more than 15,000 gift cards worth over $5 million, then used some of them to buy electronics that were subsequently shipped overseas. The victim was Staples, reports 404 Media, which identified the retailer through clues in a court filing that does not name the company.

According to the underlying court documents, investigators learned of the hack in October 2023, after the retailer reported that hackers had issued more than 15,000 gift cards worth approximately $5 million. The incident exposed a weakness in a system that the company believed could only be accessed from its internal network.

The hackers allegedly found a way to access an internal customer support system, called Nexus, and used repeated “heap dump” requests to capture information stored in the application’s memory. That information helped them hijack or mimic sessions belonging to logged-in customer service representatives, allowing them to create fraudulent gift card orders. Although the company’s fraud detection system, Kount, flagged and declined some suspicious orders, investigators found that plenty of them were still marked for fulfillment.

01 apiece. That reduced the cost for the attackers from $400,000 to $20. The order listed an invalid gift card number as payment, even though the retailer did not allow customers to buy gift cards with other gift cards. However, payment and fraud holds were bypassed, and the gift cards were sent to email accounts controlled by the outside parties.

Source link