Disney employee sentenced for hacking menu system and endangering guests

In a federal court, a former Disney employee, Michael Scheuer, was sentenced to three years in prison for hacking into the company's menu production systems in Florida. The hacking incident, which occurred prior to his termination on June 13, 2024, involved altering essential allergen information on digital menus, including falsely indicating that certain menu items were peanut-free, posing significant health risks to guests with allergies. Additionally, Scheuer was noted for adding profanities to the menus and disrupting the system by making unauthorized changes to pricing and menu fonts, ultimately forcing Disney to take their menu creation application offline to restore normal operations. Scheuer, who was employed as a menu production manager, had access to secure internal servers that were critical for the creation and publication of all restaurant menus across Disney's theme parks. His actions led to numerous changes that not only threatened public health but also rendered the menu creation system ineffective for a period of time. The complaint against Scheuer included claims that he attempted to lock out approximately 14 employees from their accounts, resulting in widespread disruption. Upon being questioned by the FBI during their investigation, Scheuer initially denied any wrongdoing and claimed that his termination was unjust and improperly handled by Disney, even suggesting that the company was framing him. His attorney pointed out Scheuer's disability and claimed that Disney had failed to accommodate his conditions, resulting in a contentious firing. Nevertheless, in January, Scheuer pleaded guilty to charges of computer fraud and aggravated identity theft. As a part of the sentencing, the court ordered Scheuer to forfeit his computers and pay restitution amounting to $687,776.50, largely compensating Disney for the damages incurred. The sentence reflected a plea from Scheuer’s attorney for a lesser punishment, as the prosecution had sought a harsher penalty. Ultimately, this incident raised serious concerns about cybersecurity practices within major corporations like Disney and highlighted potential risks that employees, including those with disabilities, may pose in sensitive operational roles when influenced by personal grievances.