AG: Grand Haven man charged after mPerks points stolen

LANSING, Mich. (WOOD) — A Grand Haven man has been charged with nine felonies after reports of Meijer mPerks points being stolen, Michigan Attorney General Dana Nessel announced at a Thursday news conference.

Nicholas Mui, 22, has been charged with one count of conducting a criminal enterprise, one count of using a computer to commit a crime and seven counts of identity theft, Nessel said. The first two charges are 20-year felonies, while identity theft is a five-year felony.

“Meijer customers and mPerks account holders had their mPerks accounts compromised, login credentials sold online and their accrued purchase points stolen and used fraudulently,” Nessel said at the news conference in Lansing.

In April and May 2023, Nessel said, Meijer received complaints from customers of “vanishing points” on mPerks accounts.

A joint investigation involving Meijer, the AG’s FORCE team and the Michigan State Police led authorities to find “encrypted chats in foreign online markets, where mPerks account credentials were being offered for sale, advertised with the corresponding points contained within each account,” Nessel said.

Among the sellers, Nessel said, investigators identified a primary suspect: Mui. While executing a search warrant at Mui’s Ottawa County home, authorities found “a significant amount of evidence” and seized over $20,000 in cash, as well as $460,000 in digital currency wallets, according to the attorney general.

“It’s alleged that Nicholas Mui obtained hacked login credentials, cross-referenced those credentials for access success with the mPerks infrastructure and then sold those login credentials — username, email address, password and PIN — on the internet for the wrongful use of buyers,” Nessel said. “And the purchasers of those login credentials then used those point balances to fund their own purchases from Meijer.”

Investigators believe they have apprehended “the main operative and driver of this sophisticated, widespread criminal enterprise” with the charges against Mui, according to Nessel.

While the Grand Haven resident has been charged with seven counts of identity theft, correlating to victims from Bay, Emmet, Ingham, Kent, Livingston, Marquette and St. Joseph counties, Nessel said there are many more victims.

“It’s apparent this crime was committed against hundreds of accounts and Meijer customers,” she said.

According to the attorney general, Meijer has taken on the cost of the thefts.

“All verified theft victims have been reimbursed for their lost points,” she said. “Meijer has reinstated the full previous balance of accrued points to the affected customers suffering thefts, at a corporate loss estimated to exceed a million dollars.”

Nessel said investigators do not believe Meijer’s platform was hacked. Rather, they believe the login credentials came from other data breaches on separate platforms, particularly a “major breach” of health app MyFitnessPal that happened years ago.

“Consumers should heed this warning and exercise smart password discipline,” Nessel said. “If you’re notified of a data breach, any data breach, you should be changing your login credentials — not just with that breach point platform, but also with any other accounts for which you’ve used the same login credentials.”

Mui was arraigned Dec. 27 in 59th District Court. His next court appearance is set for Jan. 9.

For the latest news, weather, sports, and streaming video, head to WOODTV.com.