Michigan man pleads guilty in mPerks cyber theft that cost Meijer more than $1 million

(CBS DETROIT) - A 22-year-old Michigan man will give up $630,000 in cryptocurrency and cash as well as his computer tower after pleading guilty in a massive mPerks cyber theft scheme that cost Meijer more than $1 million.

Nicholas Mui of Grand Haven pleaded guilty on Monday to one count of conducting a criminal enterprise in the theft and sale of information associated with mPerks accounts, the Michigan Attorney General's Office said.

Mui was charged in December 2023 following a lengthy investigation by Michigan State Police's Fraud Investigation Section and the FORCE team. He had faced up to 10 felony charges for the scheme.

mPerks is Meijer's loyalty and rewards program that allows customers to accrue store credit points that can be used as cash toward store purchases.

The attorney general's office alleges that Mui obtained the login credentials of some mPerks users in a separate data breach, cross-referenced those credentials for access to the mPerks infrastructure and sold the credentials on the internet. Those who purchased the login credentials used the point balances to make their own purchases from Meijer online and in stores.

Mui allegedly operated the criminal enterprise out of his Ottawa County home.

Meijer was first made aware of the thefts in April and May 2023, when customers complained that mPerks points had vanished from their accounts.

Meijer has since reinstated the full previous mPerks balances of those customers impacted by the theft, at an estimated loss that exceeds more than $1 million to the company.

"I commend the hard work and dedication of the FORCE team, Michigan State Police, and Meijer that led to this conviction," Attorney General Dana Nessel said in a statement. "Their complex investigation has been instrumental in securing hundreds of thousands of dollars in restitution and safeguarding a loyalty program used by many across our state."

Mui is scheduled to be sentenced on Sept. 5.