A disgruntled former Disney World employee who hacked into the computer systems and laid a potentially deadly trap for guests will spend three years in prison.
Michael Scheuer, 40, was sentenced last week for knowingly transmitting a program, code or command to a protected computer and intentionally causing damage and for committing aggravated identity theft, federal prosecutors announced.
He must also forfeit the computer he used to hack into the amusement park’s menu software and was ordered to pay $687,776 to his victims after he removed all mentions of allergens from the menus at Disney World’s many eateries.
Scheuer had worked as the park’s Menu Production Manager, but was fired from Disney on June 13, 2024, according to a criminal complaint.
Following the ouster – which Scheuer described as ‘contentious’ – he accessed the company’s menu system, Menu Creator, from a personal device on multiple occasions between July and September of that year, he admitted in a plea agreement obtained by the Orlando Sentinel.
He then added notations to certain menu items falsely indicating they were safe for people with specific allergens including peanuts, tree nuts, shellfish and milk ‘when in fact they could be deadly to those with peanut allergies,’ the criminal complaint against him read.
Scheuer also changed the wine regions on the menus to areas that had recently survived mass shootings, imbedded or added a swastika to at least one menu item and changed QR codes to direct guests to a website that urged boycotting Israeli companies and those that did significant business there.
In one instance, he even changed the name of a menu item from ‘cheesy grits’ to ‘cheesy [expletive],’ USA Today reports.
Michael Scheuer, 40, was sentenced last week to three years in prison for hacking into Disney World’s menu system
He had worked as the park’s Menu Production Manager, but was fired from Disney on June 13, 2024
Scheuer used a VPN while hacking into the system which encrypts data and hides a user’s IP address. He then used his administrator account to create another account under the alias, Emily P. Beaman.
Fortunately, officials at Disney Parks noticed the menu changes before they were distributed to any guests and are no longer using the Menu Creator software he hacked.
They then conducted an internal investigation and flagged Scheuer as a potential suspect to the FBI.
From there, the Bureau executed a search warrant at his home on September 23, 2024, at around 12:48 pm. Just two minutes before, Disney officials said Scheuer stopped the cyber attacks.
He then claimed that Disney was attempting to frame him because of the ‘conditions under which he was terminated,’ the criminal complaint read.
But investigators seized Scheuer’s electronics and found evidence of the hacking crimes.
They also found that Scheuer prevented 14 Disney employees – including some former coworkers – from their company accounts through denial-of-service attacks.
The accounts had been set up to lock out after too many failed login attempts, which Scheuer exploited by using a script to make automated attempts totaling over 100,000.
Scheuer’s altered menus never made it to print so no one was harmed due to the false allergen warnings (stock image)
Some of the employees that were targeted in the attack were involved in the decision to fire him for ‘misconduct.’
Additionally, Scheuer had collected the personal information of about four employees that he targeted in the attack, including their phone numbers, email addresses, physical addresses and names of their family members.
According to Scheuer’s lawyer, David Haas, Disney fired him after he returned from paternal leave.
He noted that his client has a disability that affected his employment and claimed Scheuer had been seeing a psychiatrist for mental health issues he has had since childhood.
By June, Scheuer pleaded guilty to the charges.
He will now receive credit for the six months he has already spent behind bars, and Haas told NBC News he hopes the father-of-three will be released after serving just 85 percent of his sentence.
‘He is very remorseful and apologized to the victims during the hearing,’ Haas said, noting that Scheuer is also ‘eager to get back home to his wife and three young daughters.
‘He was the sole earner in the family, as his wife has a number of medical issues and homeschools their children, so he will look for work upon his release.’
