Former Disney Employee Accused of Hacking Menu Software to Change Food Allergy Info

Getting fired is clearly an upsetting experience, and not everybody handles it particularly well. Case in point: a federal criminal complaint accuses one former Disney employee of hacking the software that generated the food and drink menus at the company’s resorts. These attacks even went so far as to dangerously alter allergen information on the menus, the government claims.

The complaint, brought by the Justice Department, says that the former employee, Michael Scheuer, committed a variety of computer crimes after being sacked by the company. The impacted company is unnamed in the complaint, identified merely as “Company A.” However, 404 Media reports that the resort in question is Disney, citing a confirmation from the lawyer representing the former employee. Gizmodo reached out to Disney for comment.

In his role at Disney, Scheuer was “responsible for the creation and publishing of menus for the entire restaurant portfolio,” the complaint claims. The software in question, dubbed Menu Creator, was developed by a third-party for Disney’s exclusive use, 404 reports. Due to his role, Scheuer possessed “intimate knowledge of…[the Menu Creator software’s] system architecture, the menu processing workflow, and potential vulnerabilities within the system.”

Scheuer was fired for “misconduct,” the complaint alleges, and his termination is described as having been “contentious and was not considered to be amicable.”

The attacks on the company took place over a period of three months, during which time Scheuer “manipulated the menus of restaurants owned and operated by” Disney, the complaint states. The more “benign” of these attacks involved defacing various menus by changing their font to Wingdings, thus rendering them incoherent. In other cases, Scheuer allegedly interjected profanity into the menus. The more serious crimes, meanwhile, involved Scheuer’s efforts to manipulate allergen information on the menus. Scheuer is also accused of conducting denial-of-service attacks on the work accounts of several of his former colleagues.

David Haas, an attorney for Scheuer, told Gizmodo via email:

The criminal allegations acknowledge that no one was injured or harmed by any menu alterations. Mr. Sheuer has a disability that impacted his employment at Disney. He had a medical event that resulted in him being suspended. Disney then failed to respond to his inquiries about why he was suspended and then his suspension was inexplicably changed to a termination. Disney refused to provide a response as to why he was fired and made no accommodations for him. He subsequently filed an EEOC complaint. I look forward to vigorously presenting my client’s side of the story.

Weirdly enough, Disney was recently hit with a “wrongful death” lawsuit after a woman died while dining at a restaurant operated on one of Disney’s Florida properties. The woman and her husband had been incorrectly told by their waiter that the meal she had ordered could be made without dairy or nuts. The case rose to prominence after Disney attempted to get the case thrown out based on a forced arbitration clause in the couple’s Disney+ trial subscription. After much outcry, Disney announced it would desist with its gross legal strategy and let the lawsuit go to trial.

However, that case is unrelated to the one involving Scheuer. While Scheuer altered allergen information in restaurant menus, those menus were never actually distributed to their respective venues.