Ex-Disney Employee Accused of Hacking Company Systems, Tampering with Allergen Information on Menus
A former Disney employee allegedly hacked the company’s internal systems to alter restaurant menus, including falsifying allergen details and adding offensive language, according to a federal complaint filed in Florida.
The complaint, submitted to the U.S. District Court for the Middle District of Florida on October 23, does not explicitly name Disney. However, David Haas, the lawyer for the accused, confirmed Disney’s involvement to CNN.
Identified in the complaint as Michael Scheuer, the former menu production manager was dismissed in June due to alleged misconduct. The complaint alleges that after his termination, Scheuer accessed Disney’s proprietary software multiple times, launching a cyberattack that manipulated menu content across Disney-operated restaurants. These alleged changes included adjusting prices, adding profanity, and altering allergen information that could risk the health of those with severe allergies by inaccurately labelling certain items as allergen-free.
The attack disrupted Disney’s menu creation system for up to two weeks, forcing the company to rely on manual processes to restore functionality. In one instance, Scheuer allegedly modified the text to display icon symbols, or “wingdings,” causing system-wide inoperability. Disney eventually identified and removed all tampered menus before distribution.
Scheuer denied any involvement, stating that Disney is “attempting to frame him” due to his firing circumstances. His attorney, Haas, noted that Scheuer, who has a mental health disability, was initially suspended after a panic attack at work. Haas claims Disney did not respond to Scheuer’s inquiries regarding his termination, prompting him to file a complaint with the Equal Employment Opportunity Commission (EEOC).
Disney declined to comment, while the U.S. Attorney’s Office for the Middle District of Florida did not provide a statement.
The complaint also describes alleged sabotage of employee accounts, with Scheuer using a bot to attempt over 100,000 logins, locking out at least 14 employees. Additionally, he allegedly manipulated QR codes on Disney menus, redirecting users to an external site urging boycotts of businesses associated with Israel. Disney reported that it caught these QR code changes before menus reached any restaurant locations.
The cyberattack reportedly cost Disney a minimum of $150,000 in damages.
