A fired Disney World employee pleaded guilty Friday to hacking into menu-creation software used by the company’s restaurants to falsely show certain food items didn’t contain peanuts and other allergens.
Michael Scheuer, of Winter Garden, pleaded guilty to one count of computer fraud and one count of aggravated identity theft as part of a plea deal with prosecutors. He was previously a menu production manager for Disney before he was terminated for misconduct in June, according to a criminal complaint filed in federal court.
False information on food allergies could have deadly consequences, but it is believed all of the altered menus were isolated before being shipped to restaurants.
Scheuer was arrested in October following an FBI investigation. While court records don’t mention Disney World by name, Scheuer’s lawyer, David Haas, said in a statement to the Orlando Sentinel at the time of the arrest that Scheuer had been employed there. In his signed plea agreement, Scheuer admitted to breaching the company’s software several times from around July to September.
Most notably, Scheuer added notations to certain menu items falsely indicating they were safe for people with specific allergies such as to peanut, tree nut, shellfish and milk, according to the plea deal.
He changed wine regions on wine menus to areas that had recently suffered mass shootings, imbedded or added a swastika to at least one menu and changed menu QR codes to direct patrons to a website that urged boycotting Israeli companies and those with significant activities there, the plea agreement shows.
Scheuer also blocked 14 Disney employees — including some former coworkers — from their accounts through denial-of-service attacks, records show. The accounts were set to lock after too many failed login attempts and he used a script to make automated attempts totaling over 100,000. The criminal complaint against Scheuer said some of the targeted employees were involved in his firing.
After an internal investigation, Disney flagged him to the FBI as a potential suspect. The agency executed a search warrant at Scheuer’s residence in September and seized several of his electronic devices, records show. He initially denied involvement in the cyberattacks and said the company was trying to frame him, according to the complaint.
The FBI discovered he’d collected personal information about four employees targeted in the cyberattack, including phone numbers, email addresses, physical addresses, and names of family members and relatives, the complaint says.
The night before his arrest, Scheuer drove to the home of one of the targeted employees shortly before 11 p.m., walked to the front door and gave a thumbs up to the Ring doorbell camera before leaving, according to the plea deal. As a result of his actions, the employee left his residence and was placed in a hotel by Disney.
Disney no longer uses the Menu Creator software hacked by Scheuer, and has moved to a manual menu approval and distribution process while a new system is developed.
No sentencing date has been set, according to court records.