Lansing, MI - Michigan Attorney General Dana Nessel announced Thursday, January 4, 2024 the arrest and arraignment of Nicholas Mui, 22, of Grand Haven, in connection to the systemic theft and sale of account access information tied to "mPerks" accounts.
Mui was arraigned in the 59th District Court in Kent County on December 27th on one count of Conducting a Criminal Enterprise, a 20-year felony, one count of Use of a Computer to Commit a Crime, a 20-year felony, and seven counts of Identity Theft, each count a 5-year felony.
mPerks is the loyalty and rewards incentive program offered by the Meijer grocery chain wherein customers accrue store-credit points into their individual accounts by making purchases at the grocer. The points accrued can be used as cash-value towards purchases. Customers establish their own individual accounts to participate in the loyalty program and these are maintained by Meijer. Meijer customers and mPerks account holders had their mPerks accounts compromised, login credentials sold online, and their accrued purchase points stolen and used fraudulently.
It is alleged that Nicholas Mui obtained login credentials from a separate data breach, cross-referenced those credentials for access success with the mPerks infrastructure, and then sold those login credentials on the internet for the wrongful use of buyers. The purchasers of the login credentials then used the points balance to fund their own purchases from Meijer, with incidents documented in both online and in-store purchases.
It is not believed that Meijer’s infrastructure was directly breached, but that this was a case of "credential stuffing," whereby account credentials obtained in large scale data breaches are batched and sold. Regardless of the source of the data, the originating breach target, the credentials are then processed through a software searching for successful access attempts across other login databases. For Meijer customers who used the same username and password on the original breached account and their mPerks account, access was granted and many of these credentials were sold or offered for sale.
“Consumers should heed this warning and exercise smart password discipline,” said Nessel. “If you are notified of a data breach, you should be changing your login credentials not just with that breach point platform, but also for any other accounts for which you use the same login credentials. Additionally, consumers should be changing their passwords at regular intervals, and not employing the same usernames and passwords across multiple platforms.”
Meijer was alerted to these thefts by consumer complaints to the company in April and May of 2023. The customers complained of vanishing points on their accounts, prompting Meijer to contact the Fraud Investigation Section of the Michigan State Police. A joint investigation commenced, comprised of Meijer corporate investigators, the Michigan State Police Fraud Investigation Section, and the FORCE Team. In September, a search warrant was executed and over $400,000 in cash and cryptocurrency were seized in connection to this alleged operation.
Meijer has reinstated the full previous balance of accrued points to affected customers suffering verified thefts, at a corporate loss currently calculated to exceed $1,000,000.
“This theft operation affected hundreds of Meijer customers and mPerks account holders, and cost the grocery chain over one million dollars,” said Nessel. “It is our belief we apprehended the main operative and driver of this sophisticated, wide-spread criminal enterprise, and I’m grateful for the partnership between my FORCE Team, the Michigan State Police, and Meijer.”
Mui will next appear before the 59th District Court on January 9th for a probable cause conference.
The FORCE Team and the Organized Retail Crime Unit were established in January of 2023 by the Attorney General to target criminal organizations that steal products from retailers to repackage and sell for a profit. Two assistant attorneys general serve the unit full time, working with special agents within the Department of Attorney General and Michigan State Police detectives to investigate and prosecute these crimes. In September, the Department announced a partnership with the FBI’s Detroit Fraud and Financial Crimes Task Force, which has assigned a special agent to the FORCE Team to assist State efforts to combat organized retail crime. This is a first-in-the-nation unit, unique in the 50 states as being the first such unit with embedded, dedicated staff from the Department of Attorney General.
The FORCE Team is dedicated to working collaboratively with retailers and local law enforcement agencies to combat organized retail crime. Recent corporate partners on investigations have included Sam’s Club/Walmart, Meijer, Target, Home Depot, TJ Maxx, Rite-Aid, Lululemon, Ulta, and Lowe’s. The team’s first major investigation produced charges against seven individuals early last year. Local law enforcement agencies or retailers with evidence of organized retail fraud are encouraged to
Please note: A criminal charge is merely an allegation, and the defendant is presumed innocent unless and until proven guilty.