Michigan Attorney General Dana Nessel says Meijer customers in several counties have had their personal information stolen by a Grand Haven man who obtained their login information for Meijer’s mPerks program.
22-year-old Nicholas Mui is charged with one count of conducting a criminal enterprise, one count of use of a computer to commit a crime, and seven counts of identity theft. He’s facing up to 20 years in prison.
Mui is accused of the theft and sale of account access information tied to mPerks accounts, which is a Meijer loyalty program. Nessel says a lot of people have been affected.
“The seven counts of identity theft account for seven specified account thefts, although it’s apparent this crime was committed against hundreds of accounts and Meijer customers,” Nessel said. “We have charged identity theft in connection with victims in Bay County, Emmet County, Ingham County, Kent County, Livingston County, Marquette County, and St. Joseph County.”
It’s alleged that Mui obtained login credentials from a separate data breach, cross-referenced those credentials for access with the mPerks infrastructure, and then sold those login credentials on the internet. The purchasers of the login credentials then used the points balance to fund their own purchases from Meijer, with incidents documented in both online and in-store purchases.
It’s not believed that Meijer’s infrastructure was directly breached, but that this was a case of “credential stuffing.”
Mui was arraigned in Kent County last month.
