() – A fired Disney employee allegedly hacked the company’s servers to alter its restaurant menus, falsifying allergen information and printing profane language, according to a federal criminal complaint filed in Florida.
The complaint, filed Oct. 23 in the U.S. District Court for the Middle District of Florida, does not name Disney. However, David Haas, an attorney representing the suspect in the case, confirmed to that Disney is the company involved in the complaint.
Disney identified and removed all altered menus before sending them to restaurants, according to the complaint.
The complaint was initially reported by 404 Media and Court Watch.
Michael Scheuer, who worked as a menu production manager for Disney, was fired in June for misconduct, according to the complaint. Scheuer had access to and used secure internal servers to create and publish menus for all Disney restaurants as part of his job at the company, according to the complaint.
After being fired, Scheuer repeatedly hacked the company’s proprietary software, which creates and distributes menus to Disney-operated restaurants, according to the complaint, kicking off a months-long campaign of cyberattacks against the company and its employees.
Scheuer allegedly hacked into Disney’s menu creation servers multiple times to manipulate and alter menus, such as changing prices and adding profane language. Scheuer then made menu changes that “threatened public health and safety,” the complaint says, including altering allergen information to indicate that certain peanut menu items did not contain peanuts, posing a fatal risk to people with peanut allergies.
Scheuer denied any wrongdoing and said Disney was “trying to frame him” because they were concerned about the conditions under which he was fired, according to the complaint.
Haas, an attorney representing Michael Scheuer, told that the allegations “acknowledge that no one was injured or harmed.”
According to Haas, Scheuer has a “mental disability” that caused him to have a panic attack at work, and he was initially suspended and then fired. “Disney did not respond to his questions about his termination and, in response, he filed a complaint (with the Equal Employment Opportunity Commission),” Haas said.
Disney and the U.S. Attorney’s Office for the Middle District of Florida declined to comment.
In July, the company conducted an internal investigation and discovered changes made to its menu creation system that rendered all menus unusable, according to the complaint. Disney’s menu creation system was affected for a week or two, according to the complaint, and manual processes had to be used to fix the menus.
Disney employees discovered the outage when Scheuer altered menu text fonts into iconic symbols, known as wingdings.
“This change was so significant that it caused the Menu Creator system to stop working while font changes were being made to all menus,” the complaint alleges. “Company A was forced to take the Menu Creator app offline while they went back to backups to regain uptime.”
Additionally, Scheuer allegedly disabled employee accounts during his hacking campaigns. He allegedly locked out the accounts of at least 14 Disney employees by continually trying to log into their accounts with incorrect passwords. Scheuer used a bot to attempt more than 100,000 logins to his accounts, rendering them unusable, according to the complaint.
According to the complaint, Scheuer also allegedly altered QR codes on Disney’s menu to direct people to a website that advocated boycotting companies associated with Israel. Disney printed the altered QR codes, but identified and deleted them before sending them to restaurants, according to the complaint.
Scheuer’s cyberattacks cost Disney at least $150,000, according to the complaint.
Add Comment