Ex-Disney World Employee Charged in Cyberattack, Manipulating Menus and Allergy Warnings
In Orlando, Florida, Michael Scheuer, a former Disney World menu production manager, faces federal charges for allegedly hacking Disney’s proprietary “Menu Creator” system following his contentious termination in June 2024. The FBI’s criminal complaint details a series of cyberattacks over three months, from mid-June until September 2024, that disrupted Disney’s restaurant operations. Scheuer reportedly exploited his knowledge of the system to alter menu data, making unauthorized changes to fonts, prices, and even adding profanity. Most alarmingly, Scheuer manipulated allergen information, incorrectly labeling items as safe for those with peanut allergies, which could have put Disney guests’ health at serious risk. Although Disney’s team identified and isolated the altered menus before public release, the attacks caused over $150,000 in damages and required Disney to suspend its menu operations temporarily.
An FBI investigation, prompted by Disney’s internal incident response, traced the cyberattacks back to Scheuer’s computer, where he allegedly used the Mullvad VPN service to mask his IP address, obscuring his online activity. After a search warrant, agents found his personal devices containing a “dox” folder with sensitive information on colleagues involved in his firing. Evidence from these devices linked Scheuer to denial-of-service (DoS) attacks on employee accounts, with over 100,000 login attempts causing account lockouts and disrupting Disney operations. FBI findings indicated that Scheuer’s attacks targeted specific employees connected to his termination, suggesting a deliberate pattern of retaliation.
Scheuer has denied the allegations, claiming Disney is framing him due to the circumstances of his dismissal. His attorney, David Haas, stated his intent to challenge the charges, emphasizing that no physical harm resulted from the attacks. Neither Disney nor the U.S. Attorney’s Office has commented publicly on the case, which adds to heightened scrutiny of Disney World’s guest safety practices around food allergens. The criminal complaint surfaces in the wake of recent legal issues related to allergen safety at Disney, drawing attention to cybersecurity risks and public health at the widely visited resort.