Chinese Crime Ring Exploits Staples Support System for $5 Million Fraud
Hackers manipulated internal support tools to generate fraudulent gift cards for overseas electronics smuggling.
1Internal System Vulnerability Exposed
Hackers breached Staples by exploiting the Nexus internal customer support system. By performing repeated heap dump requests, they captured memory data to mimic active service representative sessions. This unauthorized access allowed them to bypass security protocols, ultimately generating over 15,000 fraudulent gift cards with a total value exceeding $5 million.
2Bypassing Fraud Detection Mechanisms
Despite the presence of the Kount fraud detection system, attackers successfully manipulated order parameters. In one instance, they reduced the cost of 2,000 Target gift cards from $400,000 to just $20 by setting a $0.01 price per unit. These orders bypassed standard payment holds, allowing the cards to be issued directly.
3Coordinated Retail Redemption Strategy
The criminal group redeemed these cards across Target, Lowe’s, and Sephora locations. Target reported 3,850 cards worth $141,000 used in 300 transactions across 18 states. Attackers frequently visited physical stores to purchase high-value electronics like Apple products, often returning items to consolidate balances onto new, untraceable gift cards for further use.
4Logistics of Smuggling Operations
The operation utilized U.S.-based cells to purchase electronics, which were then consolidated in warehouses. Goods were shipped to China, Hong Kong, and Southeast Asia. Operators maximized profits by working in states without sales tax, such as New Hampshire, and communicated via WeChat, receiving payments in cryptocurrency or Chinese bank transfers.
5Evidence Found in Raids
January 2024 raids on residences and warehouses revealed the scale of the operation. Investigators discovered 35 iPhones in a closet and 24 in a bathroom vanity at one location. A warehouse operated by Jin Bin Ren contained over 7,000 electronic items, shipping labels addressed to China, and approximately $10,000 in cash.
6Individual Roles and Compensation
Court documents detail specific responsibilities, with Naxin Wu linked to $1.4 million in fraudulent cards and Mengying Jiang to $3 million. Operatives like Mingdong Chen were paid roughly $10 per device for purchasing and packaging electronics. Chen admitted to receiving instructions from a boss via WeChat and suspected the cards were stolen.
7Broader Organized Crime Context
The Department of Justice notes this incident is part of a larger trend involving Chinese criminal groups. These syndicates have obtained over $100 million through gift card fraud, physical card tampering, and pig butchering scams. The Staples breach highlights the severe risk posed when internal corporate tools are accessible from external networks.
8Operational Security Implications
This case underscores the critical need for strict segmentation between internal support tools and external-facing networks. The ability of attackers to mimic employee sessions demonstrates that traditional fraud detection is insufficient against sophisticated memory-based exploits. Companies must prioritize securing internal memory dumps to prevent similar large-scale financial losses in the future.
Original article: Gizmodo — Chinese Crime Ring Exploits Staples Support System for $5 Million Fraud