Meijer - Keep track of your points!
View attachment 823251
A Grand Haven (Michigan) man was arrested after allegedly stealing Meijer “mPerks” account information and selling them online
Attorney General Dana Nessel held a press conference on Jan. 4, announcing
Nicholas Mui, 22, was charged with the following:
- One count of criminal enterprise – a 20-year felony
- One count of use of a computer to commit a crime – a 20-year felony
- Seven counts of identity theft – 5-year felonies each
The identity theft investigation began in April and May 2023 after Meijer customers noticed points were vanishing from their mPerks accounts.
According to Nessel, the crime was committed against hundreds of accounts spanning across the following counties:
- Bay
- Emmett
- Ingham
- Kent
- Livingston
- Marquette
- St. Joseph
Mui was arraigned on Dec. 27 in the 59th District Court in Kent County. He was given a $25,000 cash/surety bond. He will appear in court on Jan. 9 for a probable cause conference.
Nessel said the victims’ points were reimbursed.
“The originating breach target in this case was not believed to be Meijer,” said Nessel.
Nessel believes Meijer was not hacked or infiltrated to obtain the account credentials, but it was a case of “credential stuffing,” meaning account credentials were obtained in large-scale data breaches are batched and sold. Regardless of the source of the data, the originating breach target, the credentials are then processed through software searching for successful access attempts across other login databases. For Meijer customers who used the same
username and password on the original breached account and their mPerks account, access was granted and many of these credentials were sold or offered for sale.
Nessel added Mui was able to obtain customer information from a separate data breach. Nessel said some of the victims were part of a previous data breach of the app
MyFitnessPal, which was hacked several years ago affecting millions of users.
“Consumers should heed this warning and exercise smart password discipline,” said Nessel.
Direct link
