Staples gift card fraud: the “internal” tool was reachable from the internet
Over 15,000 gift cards, worth more than 5 million US dollars, issued through a retailer’s own tools and then spent at Target, Sephora and Lowe’s. That’s what a US search warrant application unsealed this month and analyzed by 404 Media describes. The document doesn’t name the company, but 404 Media identified it as Staples. Staples did not respond to requests for comment.
This gift card fraud case isn’t only about big chains. It started with an “internal” tool that wasn’t really internal. And many small businesses have tools like that: an admin portal, a CRM, a customer-support tool, forgotten diagnostic pages.
What happened, link by link
According to the warrant, the attackers reached Nexus from outside, a customer-support app the company believed was only accessible from its own network. Homeland Security Investigations was told in October 2023. The events date back to 2023, but they’ve only just been made public.
1
An exposed “internal” tool
Nexus, the customer-support app, was reachable from outside even though the company believed it was limited to its own network.
2
Memory dumps
The attackers sent several “heap dump” requests, which copy what the app holds in memory.
3
Hijacked sessions
That data held what they needed to take over sessions of support reps who were already logged in.
4
Cards issued
Over 15,000 gift cards created and sent to email addresses the attackers controlled.
5
Alerts bypassed
The Kount anti-fraud tool declined some orders, but many were still marked for fulfillment.
6
In-store spending
Cards shown on a phone and scanned at the register, mostly for electronics.
One detail matters: the document explains how the attackers went from the app’s memory to employee sessions, but it doesn’t say how they got outside access in the first place. The rest of the chain is very clear.
Gift card fraud: an order that should never have gone through
Gizmodo reports an example order taken from the warrant. Read it the way a fraud rule would:
INTERNAL ORDER
example described in the search warrant
Three signals that should have stopped the order
1Volume: 2,000 cards in a single order placed by a support rep.
2Amount: 200-US-dollar cards charged one cent each.
3Payment: an invalid gift card number, even though paying for gift cards with a gift card wasn’t allowed.
The Kount anti-fraud system did flag and decline some orders. But many were still marked for fulfillment, and payment and fraud holds were bypassed. An alert that blocks nothing and that nobody handles is just one more log entry.
Where the cards went
Staples fraud cards spent, as reported by retailers (in US dollars)
450 cards, online and at more than 22 stores
3,850 cards, 300 transactions, 85 stores, 18 states, in two days
about 330 cards, 1,500 online transactions
In total, about 4,630 cards were used, for about 425,000 US dollars: a fraction of the more than 5 million US dollars issued. Source: TechSpot, based on the warrant published by 404 Media.
At a Target in New Hampshire, 35 cards tied to the attack were used within one hour to buy Apple, Bose and Powerbeats products. The wider network behind the same scheme acquired more than 100 million US dollars in gift cards, according to the US Justice Department, which announced sentences for three Chinese nationals in April.
The lesson for a small business: are your “internal” tools really internal?
You may not sell gift cards. But your online store issues promo codes, your CRM can create credits, your billing software can cancel an invoice. Every tool that can create value deserves the same questions.
Session hijacking isn’t unique to Staples. We saw the same principle in Microsoft 365 session token theft: a session that already passed sign-in is worth a password and MFA. And the ASOS hack already showed that customer-communication tools are a prime target.
Five checks to do this week
For every tool that can create value (credits, refunds, codes, cards):
- ☐ Check from outside what actually responds: portals, admin pages, diagnostic addresses. Anything that doesn’t need to be public goes behind a VPN or an IP allow list.
- ☐ Disable debug and memory-dump features in production, or protect them with authentication.
- ☐ Require re-authentication before a sensitive action and shorten session lifetimes.
- ☐ Set per-employee limits and dual approval above a threshold for cards, credits and refunds.
- ☐ Make sure every fraud or security alert reaches a person who acts, not just a log.
❔ What we don’t know yet
The warrant doesn’t establish how the attackers first got outside access to Nexus, and Staples hasn’t commented. So we won’t draw conclusions about the root cause. The lesson already holds: a tool you think is internal needs to be checked from the outside.
That last check is often the weak link at small businesses: alerts exist, but nobody reads them in the evening or on weekends. Our automated 24/7 monitoring with on-call technician intervention connects the alert to the action, and our cybersecurity services start with a list of what your business actually exposes on the internet. If you host an online store, also ask your host the right security questions.
Book your free cyber check
Not sure what your tools expose on the internet, or who can issue a credit or a refund? The free cyber check reviews your portals, access and alerts, and gives you a clear priority list.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Gizmodo (October 20, 2026) : Chinese Crime Ring Allegedly Hacked Staples to Mint 5 Million in Gift Cards
- TechSpot (October 21, 2026) : Staples hackers created more than 15,000 gift cards, then went on a shopping spree
Photo: MART PRODUCTION, Pexels (Pexels licence).