Millions of dollars worth of gift cards were stolen and then used to buy high-value tech gear at retailers like Target, Sephora, and Lowe's after a Chinese crime ring gained access to an internal Staples system and then used it to issue more than 15,000 cards to itself. While the hack hasn't been made public to date, a 404 Media report notes that it actually took place back in 2023.

The outlet reviewed court records that show that Homeland Security Investigations (HSI) was told about the hack in October of that year. The hack came to light after it led to a search warrant that was unsealed last week. And while the document doesn't specifically name Staples as the victim of the hack, 404 Media has confirmed that it was the company affected based on other information. Such information includes the fact that the victim company is headquartered in Massachusetts, that it uses Blackhawk Networks to fulfill gift card orders, and that the company uses an internal customer support system called Nexus. The report notes that a reference to Nexus can be found on a former Staples executive's LinkedIn profile.

While Staples was under the impression that Nexus could not be accessed from beyond its own network, hackers found that not to be the case. They then "performed multiple heap dump requests," a process that captures all of the data held in an app's memory. That information gave the hackers the tools they needed to hijack logged-in sessions of Staples customer service employees.

Source link