Fired Disney employee allegedly hacked the company’s system to change allergy information on menus

CNN
—

A fired Disney employee allegedly hacked into the company’s servers to alter restaurant menus, including falsifying allergen information and printing profane language, according to a federal criminal complaint filed in Florida.

The complaint, filed Oct. 23 in the U.S. District Court for the Middle District of Florida, does not name Disney. However, David Haas, an attorney representing the suspect in the case, confirmed to CNN that Disney is the company involved in the complaint.

According to the complaint, Disney identified and removed all modified menus before sending them to restaurants.

The complaint was first reported by 404 Media and Court Watch.

Michael Scheuer, who worked as a menu production manager for Disney, was fired in June for misconduct, according to the complaint. Scheuer accessed and used secure internal servers to create and publish menus for all Disney restaurants as part of his job with the company, the complaint said.

After being terminated, Scheuer repeatedly hacked into the company’s proprietary software, which creates and distributes menus to Disney-operated restaurants, the complaint alleges, and began a months-long cyberattack campaign against the company and its employees.

Scheuer allegedly hacked into Disney’s menu creation servers multiple times to manipulate and disrupt the menus, such as changing prices and adding profane language. Scheuer then made changes to the menus that “posed a threat to public health and safety,” the complaint says, including changing the allergen information to indicate that certain menu items containing peanuts were peanut-free, posing a fatal risk to persons with peanut allergies.

Scheuer denied wrongdoing and said Disney “tried to frame him” because they were concerned about the circumstances under which he was fired, the complaint alleges.

Haas, an attorney representing Michael Scheuer, told CNN that the charges “recognize that no one was injured or harmed.”

Scheuer has a “mental health disability” that Haas said caused a panic attack at work, and Scheuer was initially suspended and then fired. “Disney did not respond to his questions about his termination, and he subsequently filed an (Equal Employment Opportunity Commission) suit. complaint in response,” Haas said.

Disney and the U.S. Attorney’s Office for the Middle District of Florida declined to comment.

In July, the company conducted an internal investigation and discovered that changes had been made to its menu creation system, rendering all menus unusable, the complaint said. According to the complaint, Disney’s menu creation system was affected for one to two weeks and manual processes had to be used to fix the menus.

Disney employees discovered the disruption when Scheuer changed the fonts of menu texts to icon symbols, also called wingdings.

“This change was so substantial that it rendered the Menu Creator system unusable while the font changes were made to all menus,” the complaint alleges. “Company A was forced to take the Menu Creator application offline while they returned to backups to get back up and running.”

In addition, Scheuer is said to have disabled employee accounts during his hacking campaigns. He allegedly locked out at least fourteen Disney employees from their accounts by continually trying to log into their accounts with incorrect passwords. Scheuer used a bot to make more than 100,000 attempts to log into their accounts, rendering them useless, the complaint said.

According to the complaint, Scheuer also allegedly changed Disney menu QR codes to direct people to a website advocating the boycott of companies with ties to Israel. According to the complaint, Disney printed the modified QR codes but identified and removed them before sending them to restaurants.

Scheuer’s cyberattacks cost Disney at least $150,000, the complaint alleges.