Ex-Disney Staffer Charged For Dangerous Menu Hacks

A former Disney employee, Michael Scheuer, has been arrested and charged with hacking the company’s systems to alter restaurant menus, potentially endangering patrons’ health, as reported on Wednesday by The Register.

The complaint against Scheuer indicates that shortly after his firing, he exploited still-active work credentials to access a menu creation system contracted by Disney.

By July, he had changed all font characters to Wingdings symbols, rendering the menus unusable and knocking the system offline for weeks. The complaint detailed that when the system attempted to retrieve the original font, it instead pulled the altered files, which propagated throughout the entire database, as noted by The Report.

In addition to the font changes, Scheuer allegedly downloaded menus awaiting printing and redirected QR codes to a site urging users to boycott Israel.

Most alarmingly, he is accused of removing allergen information from menus, falsely suggesting that certain foods were safe for those with allergies. Disney reportedly identified and isolated these altered menus before they could reach restaurants, noted The Report.

The complaint further alleges that Scheuer conducted denial-of-service attacks against Disney employees by creating a script that bombarded login pages with incorrect attempts.

Investigators discovered that he had tried to cover his tracks using the Mullvad VPN, but records revealed connections to his work account. His computer also contained virtual machines with evidence linking them to the attacks, noted The Report.

Crucially, personal information of Disney employees targeted in the attacks was found on Scheuer’s computer, including details belonging to one employee’s relative. Following a tip-off from the FBI regarding a search warrant for his Google account, Scheuer reportedly appeared at the victim’s home, said The Report.

The FBI has charged Scheuer with two violations of the CFAA for knowingly transmitting harmful programs and causing significant damage. If convicted, he could face up to 15 years in prison, noted The Report.

Currently, he remains in custody pending a bond hearing, with no date set for that proceeding. Disney has not commented on the case, said The Report.