Nessel announces criminal charges for Meijer mPerks points theft scheme

Michigan Attorney General Dana Nessel announces charges her office filed in an investigation into Meijer “mPerks” account information being stolen and sold on Jan. 4, 2023. (Photo: Anna Liz Nichols)

By Michigan Advance

January 5, 2024

BY ANNA LIZ NICHOLS, MICHIGAN ADVANCE

A 22-year-old West Michigan man is facing nine felony charges from the Michigan Attorney General’s Office for what it says was a mass theft of account access to the Meijer grocery chain’s mPerks rewards program that likely spanned multiple states, impacted hundreds of customers and resulted in at least $1 million in corporate loss for Meijer.

Michigan Attorney General Dana Nessel announced at a news conference Thursday that Nicholas Mui of Grand Haven is believed to have been the main operative of the “sophisticated widespread criminal enterprise.” Nessel said her office believes Mui acquired customer usernames and passwords on the dark web and hacked and sold user information.

From April to May of 2023, Nessel said Meijer had been getting complaints from customers that their points on mPerks were missing and an investigation was opened.

“A lot of people might say … ‘Something seems fishy; I don’t know what happened, but it’s not worth it for me to say anything,’” Nessel said and implored individuals to report suspicious activity, even if it’s seemingly small like grocery rewards points.

Nessel added that older residents are often specifically targeted and in talking in town halls, she really wants to let Michiganders know that theft of customers’ personal information can lead to big problems down the road.

“A lot of times people are embarrassed,” Nessel said. “They think they did something wrong. And so they don’t want to report it. Which could lead to an escalation because now their information is already out there, but also, how are we supposed to investigate a crime that we don’t know took place?”

At only 22 years old, Mui was the head of the criminal theft operation, the attorney general’s office asserts. But Assistant Attorney General Eric Sterbis said that is not a shocking age for someone charged for this kind of crime.

“Generally speaking, crimes involving computers and technology tend to kind of favor those younger in age just by the nature of daily habits and living habits of people in their 20s and 30s. versus the older generation,” Sterbis said.

When 12 search warrants were executed for Mui’s residence, vehicles and beyond, more than $20,000 in cash and $460,000 in digital currency wallets were seized, Nessel said.

Mui’s charges stem from seven specific victims the attorney general’s office identified in the account thefts. Nessel said it’s believed that the 2018 data breach of MyFitnessPal, where some 150 million accounts were compromised, led to some of the victims’ mPerks accounts being hacked.

“If you’re notified of a data breach, any data breach, you should be changing your login credentials, not just with that breach point platform but also for any other accounts for which you’ve used the same login credentials,” Nessel said. “Additionally, consumers should be changing their passwords at regular intervals, and not employing the same usernames and passwords across multiple platforms.”

It’s not a good idea to make your password “password,” Nessel added, “That is a surefire way to have your identity stolen.”

It is not investigators’ belief that Meijer itself was hacked, but rather that Mui acquired user logins from other platforms and used software to use the same logins on mPerks.

“Meijer has reinstated the full previous balance of accrued points to the affected customers suffering thefts at a corporate loss estimated to exceed $1 million,” Nessel said. “Organized retail crime costs businesses and consumers over $1 billion every year just in the state of Michigan, from losses incurred by retailers, additional expenses of guarding against said losses and ultimately higher prices that are paid by Michigan consumers.”

Mui was arraigned Dec. 27 in the 59th District Court in Kent County, where Meijer is based, and will head back for a probable cause conference later this month.

A year ago, Nessel created the Organized Retail Crime Unit and FORCE Team within her office which work to combat real crimes. Reflecting on the charges filed in the mPerks investigation, Nessel said the FORCE team has filed over 100 felony charges against 25 different defendants for millions of dollars in losses due to retail fraud and related criminal activity.

This coverage was republished from Michigan Advance pursuant to a Creative Commons license.

READ MORE: FBI calls bomb threats at state capitols a hoax

Author

CATEGORIES: LOCAL NEWS

Politics

Local News

Related Stories
Share This