A Michigan man was arrested for allegedly stealing and subsequently selling Meijer mPerk's account information belonging to hundreds of customers in what the state's attorney general called a "widespread criminal enterprise."
Nicholas Mui, 22, of Grand Haven, was charged with felony conducting a criminal enterprise, felony use of a computer to commit a crime and seven felony counts of identity theft, according to a news release from Michigan Attorney General Dana Nessel.
According to authorities, Mui obtained login credentials for Meijer's shopper rewards program, known as mPerks, during a separate data breach, cross-referenced those credentials for access with the mPerks infrastructure and sold the login credentials on the internet. Those who purchased the credentials wrongfully used customers' points balances to make their own purchases, law enforcement alleged.
The scheme was a case of "credential stuffing," where account details acquired in large data breaches are batched together and sold, the attorney general's office said. The credentials are then processed through a software that attempts to access other databases with the same login information.
In wake of the situation, Nessel is encouraging residents to exercise smart password discipline.
“If you are notified of a data breach, you should be changing your login credentials not just with that breach point platform, but also for any other accounts for which you use the same login credentials," she stated. "Additionally, consumers should be changing their passwords at regular intervals, and not employing the same usernames and passwords across multiple platforms."
Meijer was first altered to the thefts by customer complaints in April and May of 2023. Customers reported vanishing points on their accounts, which prompted Meijer to contact the Fraud Investigation Section of the Michigan State Police. A joint investigation began, and eventually led authorities to execute a search warrant, where they seized more than $400,000 in cash and cryptocurrency, according to the attorney general's office.
Local
Meijer's losses from the scheme are estimated to exceed $1,000,000. The retail chain has since reinstated the correct points' balance to affected customers.
Feeling out of the loop? We'll catch you up on the Chicago news you need to know. Sign up for the weekly Chicago Catch-Up newsletter.
