Fired Disney World employee pleads guilty to hacking menu, court records show

Former Walt Disney World employee pleads guilty to hacking menu

The former employee at Disney who is accused of hacking into the company's online menu system and making changes has pleaded guilty.

ORLANDO, Fla. - A former Walt Disney World Resort employee pleaded guilty to federal charges for hacking into one of the company's computer systems and removing life-saving allergy information from restaurant menus.

None of the changes ultimately made it to printed or digital versions of the menu, the complaint said, but the company noted the damages exceeded $150,000.

What we know: Michael Scheurer pleaded guilty to the following charges, according to court records:

Knowingly transmitting a program, information, code, and command and intentionally causing damage without authorization to a protected computer
Aggravated identity theft

What do we know about Michael Scheurer?

The backstory: Scheuer was fired on June 13, 2024, as menu production manager for "misconduct." His firing was "contentious and…not considered to be amicable," a complaint stated.

Scheuer was responsible for the creation and distribution of all restaurant menus for the company, the complaint said, including the digital menus.

Booking photo of Michael Scheurer

The complaint alleged that Scheuer, described as a "threat actor," "made several menu changes that threatened public health and safety."

"Namely, the threat actor manipulated the allergen information on menus by adding information to some allergen notifications that indicated certain menu items were safe for individuals with peanut allergies, when in fact they could be deadly to those with peanut allergies," the complaint stated.

He also allegedly added profanity and changed the pricing of some items on the menus, according to the complaint. He also is accused of sending multiple log-in requests, sometimes known as a DDoS attack, or a denial-of-service attack, which prevented more than a dozen employees from being able to access their accounts and systems.

By The Numbers: Scheurer could face up to 10 years in prison, a maximum fine of $250,000, up to three years of supervised release, and a special assessment of $100 for knowingly transmitting a program, information, code, or command, and intentionally causing damage to a protected computer without authorization.

The second charge, aggravated identity theft, carries a mandatory minimum sentence of two years in prison, a fine of $250,000, up to one year of supervised release, and a special assessment of $100.