Fired Disney Employee Allegedly Hacked Menu System to Alter Peanut Warnings

According to a federal complaint, a disgruntled Disney employee allegedly used his still active passwords to access a menu creation system used by Walt Disney World’s restaurants. He allegedly changed the listing of foods that contained peanuts to say they were safe for people with peanut allergies.

The complaint alleges that the suspect, Michael Scheuer, hacked into the system developed for Disney print menus for its restaurants shortly after being fired.

The criminal complaint states:

The threat actor manipulated the allergen information on menus by adding information to some allergen notifications that indicated certain menu items were safe for individuals with peanut allergies, when in fact they could be deadly to those with peanut allergies.

The altered menus were discovered after they were printed but before they were distributed to Disney restaurants.

The complaint alleges Scheuer repeatedly “manipulated the menus” to change prices and add profanity but also “made several menu changes that threatened public health and safety” by changing peanut allergy information. It alleges that he initially used login credentials he had from his time at Disney, then later broke into the menu creation company’s FTP servers using separate logins after Disney reset login passwords to the Menu Creator program.

The complicated scheme is laid out in a diagram included in the complaint:

When the FBI raided the suspect’s home for evidence related to the intrusions, the complaint states that:

SCHEUER denied any involvement or wrongdoing in the activities described. Further, SCHEUER alleged that Company A [Disney] was attempting to frame him because they were worried about him and the conditions under which he was terminated. SCHEUER stated that he was surprised to see the FBI but that he would not have been surprised if the Sheriff’s office came to visit him to ask him to cease and desist with sending emails that could possibly be perceived as threatening.

The complaint also states that Scheuer allegedly locked at least 14 Disney employees out of their Disney accounts by trying to log into Disney’s online account system thousands of times with a script, maintained a folder of personal information about four employees’ homes, phone numbers, and relatives, and showed up at one of the victim’s homes at night.

404 Media asked David Haas, a lawyer representing Scheuer, if anyone had gotten sick at Disney as a result of the activities alleged in the complaint. Haas said:

The criminal complaint itself states that no one was sick or injured as no menus were used in the parks. Other than that, I have no comment on the allegations against my client.