Michigan man pleads guilty to involvement in mass mPerks cyber theft

LANSING, Mich. -- Michigan Attorney General Dana Nessel announced 22-year-old Nicholas Mui, of Grand Haven, Mich., pled guilty to one count of Conducting a Criminal Enterprise in the 17th Circuit Court in Kent County for the systemic theft and sale of account access information tied to mPerks accounts.

According to court documents, as part of his plea, Mui will forfeit his computer tower and around $630,000 in frozen cryptocurrency and cash.

Meijer's mPerks is a loyalty and rewards program where customers accrue store-credit points into their individual accounts by making purchases. Accrued points can then be used as cash-value towards purchases.

Court documents state Meijer customers and mPerks account holders had their accounts compromised, with login credentials sold online, and accrued purchase points stolen and used fraudulently.

Mui obtained login credentials from a separate data breach, cross referenced those credentials for access success with the mPerks infrastructure and sold those credentials on the internet for the wrongful use of buyers.

The purchasers of the credentials then used the points balance to make purchases from Meijer, with incidents documented for both online and in-store purchases.

Documents state Meijer was alerted to these thefts by consumer complaints to the company in April and May of 2023.

The customers complained of vanishing points, prompting Meijer to contact the Fraud Investigation Section of the Michigan State Police.

A joint investigation comprised of Meijer corporate investigators, the Michigan State Police Fraud Investigation Section, and the FORCE Team ensued.

Mui was arrested and arraigned in January after the investigation.

Meijer then reinstated the full previous balance of accrued points to affected customers of verified thefts.

 Meijer officials estimate its corporate loss to exceed $1 million.

“I commend the hard work and dedication of the FORCE team, Michigan State Police, and Meijer that led to this conviction,” Nessel said. “Their complex investigation has been instrumental in securing hundreds of thousands of dollars in restitution and safeguarding a loyalty program used by many across our state.”

Sentencing is scheduled for September 5, at 1:30 p.m. in 17th Circuit Court in Kent County.

In early 2023, Meijer made significant changes to its mPerks program.