Fired Disney employee will plead guilty to hacking menus to hide peanut content

A former Disney employee agreed to plead guilty in a federal criminal case where he is accused of hacking into menu-creation software for the company’s restaurants, to falsely indicate that certain food items did not contain potentially deadly allergens such as peanuts, a court filing Friday shows.

Michael Scheuer is also accused of making other changes to Disney restaurant menus, including altering fonts, causing some pages to be blank and changing information about wines to replace geographic regions with the locations of “recent mass shootings,” the filing says.

In one instance, Scheuer added “a swastika” to a menu, according to the plea agreement filed in U.S. District Court in Orlando, Florida. He has agreed to plead guilty to two felony counts — computer fraud and aggravated identity theft.

The Court Watch news site first reported the plea agreement.

The changes that he made to allergen information on menus “focused on peanut, tree nut, shellfish, and milk allergens,” according to the filing.

“Scheuer added notations to menu items indicating they were safe for people with specific allergies, which change could have had fatal consequences depending on the type and severity of a customer’s allergy,” the filing said.

Although it is believed that “some numbers” of the altered menus were ultimately printed, “it is believed that all altered menus were identified and isolated prior to being shipped out” to Disney restaurants.”

The plea agreement says that Disney no longer uses the third-party menu creation application that Scheuer hacked into. The company “has moved to a manual menu approval and distribution process while a new system is developed.”

Scheuer was fired as a menu production manager last June.

In August, the plea agreement says, Scheuer launched a cyberattack “designed to continually lock” Disney employees out of their company online accounts.

Many of the 14 employees targeted in the so-called denial-of-service attack had some kind of interaction with Scheuer when he worked at the company.

Federal agents raided Scheuer’s residence on Sept. 23, the filing said. The denial-of-service attacks ceased minutes before agents first made contact with him, and did not restart after his computer was seized, according to the filing.

A criminal complaint filed in October accused him of accessing menu-creation software on the heels of his termination and making the changes to Disney restaurant menus over a three-month period.

About a month after the raid, Scheuer traveled to the residence of one of the DOS attack targets, the plea agreement said. Scheuer is seen on security camera footage parking in front of the target’s home at night, approaching the front door, inspecting the label of a package outside the door, and then “giving a thumbs up to the camera” before walking back to his car, the filing said.

“The incident followed Scheuer having received notice earlier in the day of a search warrant previously executed by federal agents on his Google account,” the plea agreement said.

Because of that incident, Disney provided security to the victim of the incident, which included removing him from his home and placing him in a hotel, the filing said said.

Scheuer’s lawyer, David Haas, told CNBC that his client will enter his guilty plea in the coming weeks.

“Mr. Scheuer is prepared to accept responsibility for his conduct,” Haas said. “Unfortunately, he has mental health issues that were exacerbated when Disney fired him upon his return from paternity leave.”

“No one was ever at risk of injury and he is deeply remorseful for what happened.”

Haas said Scheuer was fired after objecting to changes in the system for creating menus at the company’s restaurants.

Haas said Scheuer will be subject to a restitution order and fine when he is sentenced. The amount of monetary loss to Disney, which has yet to be determined, will affect the range of recommended prison time for him.