Unsealed Warrant Says Hackers Hijacked a Retailer's Support Tool to Issue $5 Million in Gift Cards: What Bulk Buyers Should Check
A federal search warrant application, unsealed and reported on October 19, describes attackers who took over logged-in sessions in an office-supply company's internal customer-support system and used them to issue more than 15,000 gift cards worth over $5 million. The filing does not name the company; 404 Media, which first reported it, identifies it as Staples. Staples did not respond to requests for comment.
What the filing says
The document is an application for a search warrant by Homeland Security Investigations (HSI). According to reporting by 404 Media, Gizmodo and Gadget Review, HSI was told in October 2023 by an office-supply company that hackers had targeted it and issued the cards. The company believed its support tool could only be reached from internal machines. It could not: the attackers allegedly reached it from outside, requested heap dumps — snapshots of what an application holds in memory — and used what came back to take over sessions of support staff who were already signed in. From those sessions they could send gift cards to email addresses they controlled.
The identification of the company as Staples is 404 Media's, based on details in the filing, including the name of the support tool. The warrant itself does not name the retailer, and neither does the Justice Department's 2025 sentencing release on the wider case. We refer to “the retailer” below for that reason.
Where the cards were spent
| Merchant | Cards | Value | Average per card (derived) | How they were used |
|---|---|---|---|---|
| Target | ~3,850 | ~$141,000 | ~$37 | ~300 in-store transactions, 85 stores, 18 states, over two days |
| Lowe's | ~450 | ~$226,000 | ~$502 | 22+ store locations and online |
| Sephora | ~330 | ~$58,600 | ~$178 | ~1,500 online transactions |
| Total | 4,630 | ~$425,000 | ~$92 |
Our arithmetic on those figures: the 4,630 traced cards are about 31% of the 15,000 issued (4,630 ÷ 15,000), but their roughly $425,000 is only about 8.5% of the $5 million face value ($425,000 ÷ $5,000,000). The rest of the value was either never spent or not traced in this filing; Tom's Hardware reports the cards were deactivated after close to $500,000 had been used. Gizmodo's account of the filing also describes a 2,000-card order of $200 Target cards — $400,000 of face value — that was manipulated to cost $20, or one cent per card.
Timeline
- October 2023 — the office-supply company reports the hack to HSI, according to the warrant application.
- April 22, 2025 — three people in a New Hampshire cell of the wider scheme are sentenced to 33, 60 and 24 months for conspiracy to commit wire fraud; the Justice Department attributes $1.4 million, $3 million and $400,000 in fraudulent gift cards to them.
- October 19, 2026 — 404 Media reports the unsealed warrant application and links it to Staples.
- October 20, 2026 — Gizmodo and others publish further detail from the filing; Staples has not commented.
The Justice Department's 2025 sentencing release explains how the cards were turned into goods. Groups in China obtained gift card data by hacking U.S. companies, tampering with physical cards and running romance and elder-fraud scams, then sold it over a messaging app to U.S.-based cells for cryptocurrency. The cells, which bought the cards at a discount to face value, used them mainly on Apple products that were warehoused and shipped to China, Hong Kong or Southeast Asia. In the release's words, “The cells primarily operate in states with no sales tax, such as New Hampshire, to maximize their profits.”
What it means for reward, procurement and API teams
- Your purchased cards were not the target. Nothing in the reporting says cards bought by corporate customers were drained or cancelled. The attack minted new cards from the retailer's own systems. Still, if you bought cards from the retailer named in the reporting around 2023, a balance check on any unissued stock costs nothing.
- Deep discounts are a warning sign. The fraud only paid off because someone would buy illicit cards below face value. A supplier offering brand cards far below the usual distributor discount deserves a question about where the cards come from.
- Reconcile what you ordered against what you were billed and what was delivered. A bulk order whose price can be altered after it is placed — as the reported $20 order for $400,000 of cards shows — is a control failure on someone's side. Order-level totals, card counts and denominations should match on the invoice and the delivery file.
- For developers: support and admin paths are part of your attack surface. If your rewards platform can issue or reissue cards from an internal tool, treat that tool like the production API — not reachable from the internet, no debug or memory-dump endpoints in production, short-lived sessions, and an alert when issuance volume spikes.
Companies that buy cards at volume can compare sourcing options in our guide to bulk gift cards for employees, and developers choosing an issuing partner will find security and integration criteria in the best gift card API providers for 2026. Rewordin's own bulk gift card API delivers cards centrally rather than through ad-hoc purchases, and the analytics dashboard supports the order-level reconciliation described above. For the other side of gift card fraud — scams that target people rather than systems — see our story on the FTC's $139 million figure for older adults.
Sources
- U.S. Attorney's Office, District of New Hampshire, “Chinese Nationals Sentenced to Federal Prison for Participating in a Fraudulent Gift Card Conspiracy Involving the Purchase and Export of Apple Products to China” (April 22, 2025; republished by IRS Criminal Investigation) — scheme description, sentences, per-defendant amounts, “well over $100 million”, quoted sentence. irs.gov / justice.gov
- Joseph Cox, “How a Massive Chinese Crime Ring Hacked Staples to Steal Millions,” 404 Media (October 19, 2026) — first report of the unsealed warrant and identification of the retailer. 404media.co
- Kyle Torpey, “Chinese Crime Ring Allegedly Hacked Staples to Mint $5 Million in Gift Cards,” Gizmodo (October 20, 2026) — card counts and values by merchant, October 2023 tip, the manipulated 2,000-card order. gizmodo.com
- Annemarije de Boer, “How Hackers Allegedly Turned a Staples Support Tool Into a $5 Million Gift-Card Machine,” Gadget Review (October 19, 2026) — attack method, cards issued versus traced, merchant figures (cross-check), Staples' non-response. gadgetreview.com
- Tom's Hardware, “Chinese crime ring steals more than $5 million in gift cards from Staples customer service” (October 2026) — headline figure of nearly $500,000 spent before deactivation. tomshardware.com
- Search warrant application (Homeland Security Investigations), as published by 404 Media — primary filing; access was blocked when we tried to open it, so its contents are reported here through the articles above. documentcloud.org
This article summarizes court records as reported by the press and a Justice Department release. It describes allegations, not proven facts, and is not legal or security advice.
About the author
Maciej has worked in the digital gift card and rewards industry for over 5 years. For this story he read the Justice Department's sentencing release and the 404 Media, Gizmodo, Gadget Review and Tom's Hardware reports on October 21, 2026, cross-checked the merchant figures between two independent write-ups of the filing, and calculated the derived shares and per-card averages.