More than 15,000 fraudulent gift cards worth over $5 million were allegedly generated not by breaking into a payment system, but by compromising a customer-service tool most shoppers have never heard of. When a search-warrant application in this case was unsealed, it revealed how a retail cybersecurity failure can travel far beyond any single company and surface as Apple products on a store shelf in New Hampshire, bound for China.
The warrant did not name the targeted company. Outlet 404 Media identified it as Staples based on corroborating details: the company’s Massachusetts headquarters, its use of Blackhawk Network for gift-card fulfillment, and an internal customer-support system called Nexus. Staples did not respond to requests for comment, and the identification is 404 Media’s, not the warrant’s.
The Attack Worked Without Stealing Employee Passwords
Attackers reportedly found Nexus reachable from outside the company network, despite the company’s belief that access was restricted to internal machines.
The alleged attack chain was methodical. Hackers repeatedly requested heap dumps, which are snapshots of data held in an application’s active memory, then used the returned information to impersonate logged-in customer-service representatives.
Those hijacked sessions belonged to real employees already authenticated in the system. The reported method gave attackers the ability to issue gift cards directly to email addresses they controlled, without needing to obtain any employee’s login credentials.
When an attacker can impersonate an already-authenticated session, the login credentials become beside the point.
Thirty-Five Cards, One Hour, One Target Store
Surveillance footage at a New Hampshire Target captured four men presenting electronic gift cards on their phones in rapid succession, purchasing Apple, Bose, and Powerbeats products within a single hour.
That scene was not an isolated incident. Across 85 Target stores in 18 states, investigators identified roughly 3,850 gift cards worth approximately $141,000 redeemed over just two days, in around 300 transactions.
Sephora reported approximately 330 cards worth $58,600 redeemed across roughly 1,500 online transactions. Lowe’s identified around 450 cards totaling $226,000 used at more than 22 locations.
In total, the group redeemed 4,630 cards worth approximately $425,000 across the retailers documented in the warrant. That figure is a fraction of the more than $5 million allegedly generated through the intrusion. New Hampshire’s absence of a sales tax made it a preferred purchasing hub, according to Justice Department reporting.
Apple Products as Portable Currency
Three Chinese nationals have been sentenced in a related DOJ prosecution tied to a wider gift-card fraud network that allegedly acquired more than $100 million in cards through multiple schemes.
Consumer electronics served a specific role in this operation. Apple products and other high-demand goods are easily portable, globally recognized, and straightforward to move into resale channels abroad.
The alleged conspiracy drew gift cards from romance fraud, elder fraud, hacking, and other scams, then funneled proceeds into high-value electronics for overseas shipment. Investigators linked the reported compromise of a Massachusetts-based company’s customer-support system to this broader cross-border electronics operation.
The Attack Surface Retailers May Be Overlooking
The alleged breach moved through a support application, memory-level data extraction, and employee session impersonation before the reported fraudulent cards were issued.
The attack described in the warrant never touched a payment terminal. It moved instead through an internal support tool, a series of memory-data requests, and hijacked employee sessions.
Retailers that concentrate security resources on checkout systems and point-of-sale hardware may be leaving internal support tools, fulfillment integrations, and gift-card issuance workflows with meaningful exposure. The systems you interact with when you contact customer support can carry the same financial risk as the ones that process your credit card.
