What If the Same ORC Network Never Looks the Same Twice Across Stores?

In June 2024, detectives in the Queens District Attorney’s office were not looking for a retail theft ring. They were conducting surveillance on an unrelated matter when they noticed stolen air conditioners. That sighting, not a loss prevention alert, not a pattern flagged in a case management system, is what eventually unraveled a theft and fencing operation that had hit 128 separate Home Depot stores across nine states, generating 319 recorded incidents and a 780-count indictment¹. The crew met almost daily to decide which stores to target based on what merchandise each location carried, according to Queens District Attorney Melinda Katz, and sometimes returned to the same store four times in a single day¹. For thirteen months, that operation existed as hundreds of disconnected incident reports scattered across nine states before anyone saw it as one thing.

That is not a failure of any single store’s loss prevention team. It is what happens when detection depends on incident reports, and incident reports are built to describe one event at one address on one date.

Why the Incident Report Was Never Designed to See the Network

A retail loss prevention system is architected around the store. An incident report captures what happened at this location, on this date, involving this individual or group, resulting in this loss. That scope makes sense for the purpose it was built for: documenting a theft for insurance, prosecution referral, or internal shrink tracking at the location where it occurred.

Organized retail crime networks are not organized around the store. They are organized around evading exactly this kind of documentation. The Coalition of Law Enforcement and Retail and similar groups exist because retail investigators recognized decades ago that professional theft crews route around single-location reporting almost by design². A crew that hits the same store twice in a week creates a pattern a store manager might notice. A crew that spreads its visits across a dozen counties, rotates which members enter which store, varies the vehicle used for pickup, and routes goods through different fences depending on region creates twelve, or fifty, or two hundred reports that each look like an isolated shoplifting incident.

California Highway Patrol Sgt. Manny Nevarez, who oversees organized retail crime investigations for the agency’s Bay Area unit, described this dynamic directly to CNBC while discussing a fencing ring that had hit T.J. Maxx and drugstore locations across multiple counties: “They are not catching on that some of the retailers have their own loss prevention personnel and typically, if you target one store in San Jose, then the word gets out and then the next store is notified”³. The crew’s operating logic was explicit: spread out enough that no single store’s loss prevention team connects what they’re seeing to what the next county over is also seeing.

This is a structural limitation, not a staffing one. A store-level loss prevention analyst who is excellent at their job, who reviews every incident thoroughly, who cross-references known local offenders, still cannot see a pattern that only exists at the scale of twenty-one counties or nine states. That pattern lives in a dataset no single analyst holds. It requires someone, or something, to hold every store’s incidents in the same frame at the same time and ask whether a theft in Solano County and a theft in Yolo County share a vehicle, a courier, a resale channel, or a timing pattern that a name search would never surface.

What the Case Files Actually Show

The scale of this blind spot is documented, not speculative. Michelle Mack, sentenced in January 2025 to five years and four months for running an organized retail crime ring, operated across 21 California counties, from Alameda to Yolo, hitting more than 231 Ulta locations along with Sephora and LensCrafters stores in at least a dozen additional states including Washington, Utah, Colorado, Illinois, Texas, Florida, Pennsylvania, Massachusetts and Ohio⁴⁵. Her crew of roughly a dozen women had their airfare and rental cars paid for, and investigators say they were directed which stores to hit and what specific merchandise to clear from the shelves⁵. The operation ran for more than a decade before California’s Department of Justice, working jointly with Ulta’s and Sephora’s own organized retail crime units, Homeland Security Investigations, and the U.S. Postal Inspection Service, assembled enough cross-location evidence to charge it as a single $8 million enterprise⁴.

That case only became visible because two national retailers had built centralized loss prevention functions capable of aggregating incidents across their own store networks, and because multiple agencies chose to pool what they each independently held. Absent that private-sector aggregation layer, the same theft pattern would likely still read as hundreds of unconnected local shoplifting cases.

Federal enforcement data reflects the same underlying dynamic at larger scale. Homeland Security Investigations opened 59 organized retail crime cases in fiscal year 2021, resulting in 55 indictments and 61 arrests. By the end of fiscal 2023, cases had more than tripled to 199, indictments rose more than fivefold to 284, and arrests climbed to 386³. Whether that growth reflects more crime or more enforcement capacity is genuinely unclear, and researchers at organizations including the R Street Institute have cautioned against reading rising case counts as proof of a broader crime wave when shrink data conflates theft with administrative error, employee theft, and vendor fraud⁶. What the case-count growth does reliably show is that when agencies build cross-jurisdictional visibility, cases that were previously invisible start surfacing. The Congressional Research Service has similarly identified fragmented data systems and inconsistent state reporting definitions as a structural obstacle to seeing organized theft networks as networks rather than as accumulations of unrelated incidents⁶.

Retailers themselves report a version of this gap from the inside. Among companies with the internal capability to specifically track organized retail crime incidents as distinct from ordinary shoplifting, the National Retail Federation found a 57 percent average increase in tracked ORC incidents from 2022 to 2023, even as 76 percent of retailers said ORC-connected shoplifting was a growing concern⁷. The qualifier matters: that increase is only visible to retailers who built the tracking capability in the first place. A 2011 GAO review of organized retail crime collaboration found that information-sharing mechanisms between retailers and law enforcement existed but remained inconsistent and dependent on individual relationships and ad hoc regional task forces rather than systematic infrastructure⁸. Fourteen years later, that description still holds for most jurisdictions.

The Harder Question

If the Home Depot network needed an unrelated stakeout to surface, and the Mack network needed two retailers’ private investigative units plus four government agencies working in concert for over a decade, the uncomfortable question is not how many ORC networks get caught. It is how many networks are built well enough, spread thin enough, and varied enough in method that they never generate the accidental collision that exposes them.

It would be easy to reach for a technology answer here, more cameras, more facial recognition, more real-time alerts, but that risks missing the actual mechanism. The Michelle Mack case was not under-surveilled; the thefts were caught on camera repeatedly⁴. The gap was never visibility at the point of theft. It was the absence of a structure that could hold Solano County’s incident next to Yolo County’s incident next to a Utah incident and ask whether they belonged to the same story. That is a data architecture and workflow problem as much as a detection problem, and in some organizations the honest fix is process: standardized incident templates that capture vehicle descriptions, associate names, and resale-channel indicators in comparable fields across every store banner, paired with a discipline of actually reviewing cross-location data on a cadence, before reaching for a new sensor or dashboard.

What Seeing the Network Actually Requires

A higher standard for organized retail crime detection does not start with more incidents being reported. It starts with treating every incident as a fragment of a case file that does not yet exist, one that might connect to a theft at a different banner, in a different county, using a different vehicle, months apart. That requires preserving contextual detail, associate descriptions, vehicle plates, timing patterns, resale channel indicators, in a form that can be searched and compared across locations, not just archived per store. It requires entity resolution that works on more than a name match, since crews rotate personnel specifically to defeat name-based lookups. And it requires keeping investigators, not algorithms, responsible for the judgment call: deciding whether two incidents that share a vehicle description and a two-week gap are actually the same network, or a coincidence.

This is the kind of cross-location, cross-incident synthesis that an AI-native investigative environment like Hubstream is built to support, surfacing the connective tissue between incidents that individually look unremarkable, while leaving the interpretation and the prosecutorial judgment where it belongs, with the investigator. No software makes that call. It can only make the fragments visible in the same place at the same time, which is more than most store-by-store reporting structures currently do.

Questions Worth Asking About Your Own Program

• Does our incident reporting capture vehicle descriptions, associate details, and resale-channel indicators in fields that can be compared across store locations, or only in free-text narrative that never gets cross-referenced?
• If a crew hit three of our stores in three different counties this month, would anyone currently notice, or would it take an unrelated investigation to surface it, as it did in Queens?
• How much of our organized retail crime visibility depends on a national retailer’s centralized unit or a multi-agency task force, versus something our own reporting structure would catch on its own?
• Are we tracking ORC incidents as a distinct category at all, given that retailers who do so report far higher numbers than those who lump them into general shrink?
• When a case does connect across locations, how much of that connection was systematic versus a fortunate coincidence, a shared analyst’s memory, or an accidental stakeout?
• Would our current systems recognize the same network if it changed its crew, its vehicle, and its fence between store visits, which is precisely what sophisticated crews are designed to do?

The Air Conditioners Were Never the Point

The Queens detectives who noticed those stolen air conditioners were not running an organized retail crime investigation. They stumbled into one. That is the quiet admission sitting underneath every successful ORC prosecution built on this pattern: the network was not caught because the system built to catch it worked. It was caught because someone happened to be looking at the right moment, in the right place, for an entirely different reason. A network built to never look the same twice across stores is not defeated by noticing harder. It is defeated by building a structure that does not need luck to see what was always sitting there, one incident report at a time, waiting to be read as part of the same story.