What If the Same ORC Network Never Looks the Same Twice Across Stores?

A different person enters the store. A different vehicle waits outside. The merchandise taken is different, too.

For a retail investigator reviewing individual incidents, those differences can make a useful question harder to answer: could these thefts be connected?

The link may sit beyond the person caught on camera. It could be a shared associate, a delivery address, or someone buying and reselling the stolen goods. Finding that connection requires a way to compare information across incidents, while keeping the evidence behind each one intact.

A report captures the incident. The investigation connects it.

An incident report records what happened at a particular store: when the theft occurred, what was taken, who was involved, and what evidence is available. Those details are essential.

But when reports are reviewed only within their own locations, a connection elsewhere can be easy to miss. A vehicle noted in one report might appear in another. An address found during a later investigation might link back to an earlier case.

Consider a hypothetical example. Two stores report thefts involving different people. Nothing about their names suggests a connection. Later, investigators find evidence that both supplied goods to the same reseller. That new information gives the team a reason to revisit the earlier incidents together.

The practical question is whether investigators can find those earlier records and examine the possible relationship.

What real investigations illustrate

A Home Depot investigation in Queens offers one example of how a lead can develop beyond a single theft. According to a December 2025 announcement from New York’s governor and the Queens district attorney, detectives noticed stolen air conditioners while conducting surveillance in a separate matter. The investigation developed into charges involving an alleged theft and resale operation targeting stores across several states. Prosecutors alleged that resellers ordered specific goods for the crew to steal.¹

The Michelle Mack case illustrates a related connection between theft and resale. In its January 2025 sentencing announcement, the California Department of Justice said Mack and her husband recruited women to steal selected beauty products, which the couple then sold through an Amazon storefront. The investigation involved law enforcement agencies, Ulta’s organized retail crime team, and Sephora representatives.²

These examples show how thefts at separate stores can belong to a broader operation involving people who select, receive, and resell the goods. They do not establish that retailers failed to connect their reports, or that different software would have exposed the networks sooner.

For investigative teams, they raise a useful question: when new evidence identifies a shared person, address, or resale channel, how easily can that information be checked against previous incidents?

Make the details useful beyond one store

Cross-location review starts with information that investigators can search and compare.

Where available and relevant, reports should capture details such as vehicles, associates, contact information, merchandise, and suspected resale activity. Consistent fields help teams compare records, while narrative notes preserve context that a form may not capture.

Just as important is keeping each detail connected to its source. Investigators need to know whether a vehicle registration was verified, a witness supplied a description, or an analyst suggested a possible association. Those are different kinds of information and should remain distinguishable.

A useful workflow also allows new findings to inform older cases. An address that meant little when first recorded may become relevant months later. Investigators should be able to follow that lead back to the original report, supporting documents, and earlier conclusions.

A possible connection still needs judgment

Similarities can give investigators a reason to look closer. Their significance depends on the evidence.

The same type of vehicle or a similar selection of stolen products may be a weak lead. A verified identifier appearing in separate records may warrant more attention. Even then, investigators need to examine the context and consider other explanations.

Technology can help bring relevant records together and suggest connections for review. The investigator remains responsible for deciding what the evidence supports, what needs further checking, and what should be ruled out.

That distinction matters when AI assists with analysis. A suggested match should be traceable to the underlying information, with room for investigators to correct it and record their reasoning.

What this means for your team

A few questions can help assess how well your current process supports this work:

• Can investigators search across locations for people, vehicles, addresses, and other relevant details?
• When new information emerges, can they easily find and revisit earlier incidents?
• Can they see the source of a suggested connection and distinguish it from a confirmed relationship?
• Is someone responsible for reviewing potential links and recording the outcome?

The answers may point to changes in reporting templates, review practices, or access to information, as well as technology.

Hubstream supports this work by bringing case information, entities, and relationships into a shared investigative environment. Its AI Investigation Assistant can help teams review information and explore possible connections, with investigators validating the findings.

The aim is straightforward: give investigators enough context to recognize when apparently separate incidents deserve to be examined together.

A theft report can remain useful long after it is filed. When new evidence emerges, the team needs a way to return to it, understand its significance, and decide what to investigate next.

See how Hubstream supports investigations across locations.

---