Exclusive: Fired Disney Employee Admits to Hacking Menu System to Alter Allergy Info

A disgruntled employee admitted to breaching Disney’s computer network to alter peanut allergy on their parks’ food menus, according to a newly filed plea agreement. 

Michael Scheuer was facing a raft of charges related to his hacking of a third-party menu creation system for the Happiest Place on Earth. In the written plea agreement, Scheuer admitted to one count of intentionally causing damage without authorization to a protected computer and another for aggravated identity theft. As part of the agreement, Scheuer agreed to pay Disney restitution for damages caused by the hack as well as a fine set by the government. He also forfeited a computer tower reportedly used in the hack. Court Watch and 404 Media were first to write about the initial arrest of Scheuer in October. His new plea agreement has not previously been reported on.

“The threat actor manipulated the allergen information on menus by adding information to some allergen notifications that indicated certain menu items were safe for individuals with peanut allergies, when in fact they could be deadly to those with peanut allergies,” the original criminal complaint stated. 

Scheuer previously held the position of “Menu Production Manager” at Disney. The complaint states that Scheuer accessed a third-party-operated “Menu Creator” that Disney contracts with, which he then used to upload blank and altered images into the menu system. All of the menus in the system were reportedly disrupted by the hack, forcing the third-party operator to use backup menus. According to court records, the discrepancies in the altered menus were caught before they went into use at Disney.

The plea agreement filed today added new details about the breach, including stating that Scheuer changed the wine regions of alcoholic drinks to locations that had mass shootings. Court documents say he, in one instance, added a swastika to a menu. Scheuer also admitted to leaking the link and login he used to change the menus onto the dark web. In addition to changing allergy information on Disney menus, court records state he added profanity and changed the fonts to Wingdings. 

“Mr. Scheuer is prepared to accept responsibility for his conduct. Unfortunately, he has mental health issues that were exacerbated when Disney fired him upon his return from paternity leave.” said Scheuer’s lawyer David Haas. He continued, “No one was ever at risk of injury and he is deeply remorseful for what happened.”

Disney did not immediately return a request for comment. The U.S. Attorney’s Office of the Middle District of Florida, which is prosecuting the case, declined to comment at this time.