Hackers Exploited Staples Support System to Generate $5M in Fraudulent Gift Cards

A criminal organization allegedly exploited a vulnerability in Staples’ internal customer support infrastructure to generate more than 15,000 fraudulent gift cards with a combined value exceeding $5 million. According to court documents analyzed by 404 Media, the retailer reported the incident to investigators in October 2023 after detecting the massive unauthorized issuance. The attack leveraged a weakness in a system the company believed was restricted to its internal network.

The hackers targeted an internal application known as Nexus, using repeated heap dump requests to extract data stored in the application’s memory. This technique allowed them to hijack or mimic the active sessions of logged-in customer service representatives. With these compromised credentials, the group submitted requests to create gift card orders. Although the fraud detection system, Kount, flagged and rejected some suspicious transactions, many others were approved and marked for fulfillment.

Operational Details of the Breach

Court filings describe specific methods used to circumvent security controls during the operation. In one instance, attackers manipulated an order for 2,000 Target gift cards, each with a $200 balance, to cost only one cent each. This manipulation reduced the total transaction cost from $400,000 to $20. The order utilized an invalid gift card number for payment, violating the retailer’s policy against using gift cards to purchase other gift cards. Despite these violations, payment and fraud holds were bypassed, and the digital cards were delivered to email accounts controlled by the attackers.

The breach exposed a significant gap between the perceived security of the internal network and its actual exposure to external threats. The system designers assumed the Nexus tool was inaccessible from outside the corporate perimeter. However, the attackers found a path to reach it, demonstrating that internal-only assumptions can be misleading if network segmentation is not rigorously enforced. The ability to capture memory dumps allowed them to extract session tokens without needing individual user passwords.

Impact on Third-Party Retailers

The fraudulent gift cards generated through the Staples hack were used to purchase merchandise at several major retailers. Investigators traced approximately 4,630 cards, valued at around $425,000, to purchases made with the stolen funds. The goods, which included Apple products, were acquired through both physical stores and online platforms, then shipped overseas.

Target reported that roughly 3,850 cards worth $141,000 were redeemed in 300 transactions across 85 stores in 18 states within a two-day period. Sephora identified approximately 330 cards worth $58,600 used in around 1,500 online transactions. Lowe’s reported about 450 cards worth $226,000 redeemed both online and in person at more than 22 locations. These figures represent only the portion of the fraud that investigators could directly link to the Staples breach.

What should you do?

Organizations should review access controls for internal support systems to ensure they are not exposed to external networks. Security teams should monitor for unusual memory dump requests or session hijacking attempts in application logs. Companies should also verify that fraud detection systems are configured to catch anomalies in high-volume, low-cost transactions. Regular audits of internal tool permissions can help identify unauthorized access paths before they are exploited.

What to do and how to stay safe: Staples

• Audit internal customer support applications to ensure they are not accessible from external networks or public interfaces.
• Monitor application logs for unusual memory dump requests or patterns indicating session hijacking by external actors.
• Configure fraud detection systems to flag transactions that bypass standard payment validation or involve invalid payment methods.
• Review permissions for internal tools to ensure only authorized personnel can access sensitive customer data and order functions.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How did the attackers access the Staples internal system?

They used heap dump requests against the Nexus customer support application to capture memory data and hijack employee sessions.

What was the total value of the fraudulent gift cards generated?

The attackers generated more than 15,000 gift cards with a total value of approximately $5 million.

Which retailers had gift cards redeemed in this scheme?

Investigators linked the fraud to redemptions at Target, Lowe’s, and Sephora, totaling over $400,000 in purchases.