Previous Disney Worker Allegedly Infiltrates Menu System Software to Modify Allergy Details
Previous Disney Worker Allegedly Infiltrates Menu System Software to Modify Allergy Details
Experiencing job termination can be a distressing situation, and not everyone reacts favourably. A federal indictment accuses a previous Disney employee, named Michael Scheuer, of hacking into the software that produced the food and drink menus at Disney's resorts. According to the Justice Department's accusation, known as the complaint, these attacks went as far as to dangerously modify allergen information on the menus, as the authorities assert.
The charge, issued by the Department of Justice, alleges that Scheuer committed various computer offenses following his dismissal by the company, which remains unnamed in the complaint, mentioned only as "Company A." However, 404 Media reveals that the concerned resort is Disney, based on confirmation from Scheuer's attorney. Gizmodo contacted Disney for a statement.
In his role at Disney, Scheuer was in charge of creating and publishing menus for the entire restaurant roster, as per the complaint. The software utilized, named Menu Creator, was developed by a third-party specifically for Disney's exclusive use, according to 404. Consequently, Scheuer had intimate knowledge of the software's system architecture, menu processing workflow, and vulnerabilities within the system.
Scheuer was dismissed due to misconduct, as alleged in the complaint, and his separation was described as "contentious" and not amicable.
The hacking activities took place over a span of three months, during which Scheuer "tampered with the menus of restaurants belonging to and operated by" Disney, the complaint states. The more "trivial" alterations included defacing menus by changing the font to Wingdings, thereby rendering them unreadable. In other cases, Scheuer is accused of inserting profanity into the menus. The more serious infractions involved Scheuer manipulating allergen information on the menus. He is also implicated in denial-of-service attacks on the work accounts of several of his former colleagues.
David Haas, Scheuer's lawyer, informed Gizmodo via email:
The criminal charges acknowledge that no one was harmed or injured due to any menu modifications. Mr. Scheuer has a disability that affected his employment at Disney. He sustained a medical event resulting in his suspension. Disney failed to respond to his inquiries about his suspension, and subsequently changed his suspension to termination. Disney declined to provide a justification for his termination and did not accommodate him. Consequently, he filed an EEOC complaint. I am eager to present my client's perspective in court.
Interestingly, Disney was recently confronted with a "wrongful death" lawsuit following a woman's death while dining at a restaurant situated on one of Disney's Florida properties. The woman and her husband were misled by their server that her order could be made without dairy and nuts. The case garnered attention after Disney attempted to dismiss the case based on a forced arbitration clause included in the couple's Disney+ subscription trial. After widespread uproar, Disney renounced its questionable legal tactic and allowed the lawsuit to proceed to trial.
However, this case has no connection to the one involving Scheuer. While Scheuer modified allergen information in restaurant menus, those menus were never distributed to the respective venues.
In the future, advancements in technology and cybersecurity measures could potentially prevent similar incidents like Scheuer's hacking, strengthening the protection of sensitive data. Despite being dismissed from his job due to misconduct, Scheuer still had extensive knowledge of Disney's exclusive Menu Creator software, highlighting the importance of proper termination procedures and post-employment measures.