This browser does not support the Video element.
Fired Disney employee hacked theme park menus: complaint
A fired employee of Walt Disney World Resort allegedly hacked into restaurant menu software, adding profanity or removing serious allergy information from them, the FBI alleges in a criminal complaint. None of those changes passed safety checks and were ever displayed in front of theme park guests, the complaint said, but the risk was there. The man's attorney said his client hurt no one and that he looks forward to defending him in court.
A fired Disney employee is facing federal charges after allegedly hacking into one of the company's computer systems and removing life-saving allergy information from restaurant menus. None of the changes ultimately made it to printed or digital versions of the menu, the complaint said, but the company noted the damages exceeded $150,000.
Disney is not specifically mentioned in the federal complaint and is instead described as "a media and entertainment company," referred to as "Company A." However, David Hass, the defense attorney for Michael Scheuer, the man accused, confirmed to FOX 35 that his client's former employer was Disney.
FOX 35 reached out to Disney on Thursday for comment.
According to the complaint, Scheuer was fired on June 13, 2024, as menu production manager for "misconduct." His firing was "contentious and…not considered to be amicable," the complaint states.
Scheuer was responsible for the creation and distribution of all restaurant menus for the company, the complaint said, including the digital menus.
The complaint alleged that Scheuer, described as a "threat actor," "made several menu changes that threatened public health and safety."
"Namely, the threat actor manipulated the allergen information on menus by adding information to some allergen notifications that indicated certain menu items were safe for individuals with peanut allergies, when in fact they could be deadly to those with peanut allergies," the complaint stated.
He also allegedly added profanity and changed the pricing of some items on the menus, according to the complaint. He also is accused of sending multiple log-in requests, sometimes known as a DDoS attack, or a denial-of-service attack, which prevented more than a dozen employees from being able to access their accounts and systems.
The FBI raided Scheuer's house on Sept. 23, confiscating at least four computers.
He denied any involvement or wrongdoing to the FBI, according to the complaint, and alleged that "Company A was attempting to frame him because they were worried about him and the conditions under which he was terminated."
Here is a statement from the man's attorney, David Haas:
"The criminal allegations acknowledge that no one was injured or harmed by any menu alterations. Mr. Scheuer has a disability that impacted his employment at Disney. He had a medical event that resulted in him being suspended," he said.
"Disney then failed to respond to his inquiries about why he was suspended and then his suspension was inexplicably changed to a termination. Disney refused to provide a response as to why he was fired and made no accommodations for him. He subsequently filed an EEOC complaint. I look forward to vigorously presenting my client’s side of the story."
Disney has not responded to FOX 35's request for comment.
While he was surprised the FBI was at his home, the man told agents that he would not have been surprised if the sheriff's office had made a visit regarding "sending emails that could possibly be perceived as threatening," according to the complaint. The complaint did not elaborate on those emails.
In the complaint, the entertainment company said none of the changes made it to printed menus or digital menus, but that it had cost the company at least $150,000 in damages so far. The complaint alleged that was a conservative estimate and was still being determined.
Scheuer has been charged with one count of knowingly causing the transmission of a program, information, code, or command to a protected computer and intentionally causing damage without authorization in excess of $5,000.