Tokyo police have arrested a Chinese man on suspicion of illegally logging into the membership website of a drugstore chain to buy items using a member's points.

Police suspect the man used an ID and password leaked through a cyberattack on the Tokyo-based Sundrug chain.

The police identified the man as Li Chen, a 21-year-old resident of Osaka City.

Li is suspected of fraudulently obtaining cosmetics and other goods worth nearly 70,000 yen, or slightly more than 500 dollars, at a Sundrug store in Osaka last July.

Police say Li illegally accessed the membership website and used the points of a woman living near Tokyo.

Police say Li obtained the woman's ID and password from a suspected accomplice via social media. Li reportedly said an acquaintance told him to use the points, calling the act a "job."

Police say Sundrug's shopping website was hit by a cyberattack just before Li's case.

They say it was likely a list-based attack, in which perpetrators use lists of ID-password combinations leaked from other websites.

This type of cyberattack takes advantage of the fact that many people use the same passwords for multiple websites.

Police say the ID, password and other data obtained in the attack were given to Li.