FBI: Fired Disney World employee hacked menus to falsely show foods as peanut-free
ORLANDO, Fla. — A Disney World employee fired in June was arrested last week and accused of hacking into menu-creation software used by the company’s restaurants to falsely show that certain food items didn’t contain peanuts.
Michael James Scheuer, 39, of Winter Garden, was a menu production manager for Disney before he was terminated for misconduct, according to the criminal complaint filed in U.S District Court for the Middle District of Florida. The complaint said the firing was contentious and not amicable.
His arrest Oct. 23 followed an FBI investigation that concluded he breached the company’s software several times over three months. The complaint charges him with fraudulent activity connected with computers. He has a bond hearing scheduled for Tuesday at the federal courthouse in Orlando.
The complaint does not mention Disney World by name but his lawyer, David Haas, said in a statement to the Orlando Sentinel that Scheuer was employed there and has a disability that impacted his termination.
“Disney failed to respond to his inquiries about why he was first suspended and then was fired without explanation or accommodation,” Haas said. “He subsequently filed an EEOC complaint. The criminal allegations acknowledge that no one was injured or harmed by any menu alterations.
“I look forward to vigorously presenting my client’s side of the story.”
The complaint said Scheuer altered menus using Disney’s Menu Creator software. It was created specifically for the company and menus at restaurants it owns and operates in Florida.
In addition to altering allergen information, the complaint said he changed prices, added profanity and replaced fonts in the menu software with one that depicted symbols known as wingdings. He also altered QR codes on menus to direct patrons to a website listing names of Israeli companies and those with significant activities there for boycotting purposes.
The complaint said it’s believed altered menus were isolated before they could be shipping out to restaurants, but Disney was still working to identify all of them. Scheuer’s alleged actions are estimated to have caused at least $150,000 in damages.
Scheuer also locked about 14 Disney employees — including ones involved in his firing and former coworkers — out of their accounts with denial-of-service attacks. The accounts would lock after too many failed login attempts and he used a script to make automated attempts totaling over 100,000.
After an internal investigation, Disney flagged him to the FBI as a potential suspect. The agency executed a search warrant at Scheuer’s residence in September and seized several of his electronic devices. He denied involvement in the cyberattacks and said the company was trying to frame him because it was worried about him and the circumstances of his firing, according to the complaint.
The FBI found evidence of Scheuer’s involvement on one of his personal devices — including a virtual private network he used to mask his online identity in several of the hackings.
The agency also discovered he’d collected personal information about four employees targeted in the cyberattacks — including phone numbers, email addresses, physical addresses, family members and relatives.
After his residence was searched, the complaint said Scheuer drove to the home of one of the employees shortly before 11 p.m., walked to the front door and gave a thumbs up to the Ring doorbell camera before leaving. As a result of his actions, the employee left his residence and was staying at a hotel.
_____