404 Media reported on 19 October, citing a search warrant application unsealed last week, that a Chinese crime group hacked a retailer. In October 2023, an office supply firm warned Homeland Security Investigations, the document says. The firm put the issued cards at over 15,000, worth above $5 million. Hackers requested memory snapshots from an internal support tool and took over logged-in agents' sessions. The gang used 4,630 cards, around $425,000.
The document does not name the company. 404 Media matched it to Staples using three clues: a Massachusetts headquarters, gift card vendor Blackhawk Network, and a support system called Nexus. Staples did not respond to requests for comment. The sources do not say how the hackers reached the system from outside.
The company believed Nexus was reachable only from its own computers, the document says. A heap dump copies everything an app holds in memory at one moment. In general, that can include the login proof of staff, so its holder may act as them without a password. These are general points, not findings about Staples. Leaders can ask which internal tools face the outside, which expose memory functions, and how fast sessions can be cut off or odd gift card issuance flagged.