LANSING, Mich. — Michigan Attorney General Dana Nessel announced several charges Thursday against a 22-year-old man from Grand Haven for his alleged connection to the massive theft and sale of Meijer mPerks data.
That man, identified as Nicholas Mui, faced nine total counts:
- Conducting a Criminal Enterprise, a 20-year felony (x1)
- Use of a Computer to Commit a Crime, a 20-year felony (x1)
- Identity Theft, each count carrying a 5-year felony (x7)
Meijer's mPerks is the loyalty and rewards program for the grocery enterprise, in which points can be acquired over time to gain store credits and be used toward purchases.
Investigators started digging into this matter after mPerks account holders "had their accounts compromised, login credentials sold online, and their accrued purchase points stolen and used fraudulently," Nessel said in a press release. Customers first started complaining about points vanishing from their accounts in April and May of 2023.
She went on to say, "It is alleged that Nicholas Mui obtained login credentials from a separate data breach, cross-referenced those credentials for access success with the mPerks infrastructure, and then sold those login credentials on the internet for the wrongful use of buyers. The purchasers of the login credentials then used the points balance to fund their own purchases from Meijer, with incidents documented in both online and in-store purchases."
Nessel called this kind of act "credential stuffing." Essentially, she said, that's when account credentials are collected, batched and then sold.
Watch Nessel's full press conference on the announcement below:
Nessel said they launched a joint investigation, comprised of Meijer corporate investigators and the Michigan State Police Fraud Investigation Section and the state's FORCE team, which was created to fight organized retail crime.
“This investigation discovered encrypted chats and foreign online markets where mPerks account credentials were being offered for sale," Nessel said in a press conference Thursday.
Nessel said the sales were made on the dark web with cryptocurrency and other digital wallets. She mentioned one seller's account stood out among the rest.
“Investigators began closely scrutinizing and tracing the digital transactions of accounts used by the seller AlphaLand, and after finding an anonymous cryptocurrency exchange employed by AlphaLand, we discovered and followed over 300 digital currency wallets using five different crypto currencies," she said.
The investigation pointed to Mui's residence in Ottawa County, the location from which the alleged criminal enterprise operated.
She said a search warrant in September yielded a "significant" amount of evidence, including more than $20,000 in cash and $460,000 in digital wallets or cryptocurrencies.
"Meijer has reinstated the full previous balance of accrued points to affected customers suffering verified thefts, at a corporate loss currently calculated to exceed $1,000,000," the press release said.
In regards to the seven counts of identity theft, Nessel said, "Though it's apparent this crime was committed against hundreds of counts and Meijer customers, we have charged identity theft in connection to individual victims from Bay County, Emmet County, Ingham County, Kent County, Livingston County, Marquette County and St. Joseph County."
Mui was arraigned in Kent County's 59th District Court on Wednesday, Dec. 27. His personal recognizance bond was set at $25,000.
At the moment, Mui's Probable Cause Conference is scheduled for Tuesday, Jan. 9 at 2 p.m., and his Preliminary Examination is scheduled for Tuesday, Jan. 16 at 9:45 a.m., but attorneys are in the process of prepping for the case to be bound over to the 17th Circuit Court.
