Former Disney employee sentenced to three years for menu hacking

A former Disney employee will serve three years in federal prison for logging into the company’s servers to make changes to its restaurant menus’ allergen information, as well as carrying out “denial-of-service attacks” aimed at locking other employees out of their accounts. The court also ordered the man, Michael Scheuer, to pay nearly $690,000 in fines. Scheuer, who pled guilty to the crimes in January, had access to the company’s menu creation and editing system as part of his job there. After he was fired in June last year, Scheuer used a login shared by his team to alter the company’s menus after he was fired, in some cases adding or replacing allergen information in item descriptions, while leaving a separate allergen information sheet alone, according to court documents. Still, US attorneys argued that his changes could mislead people into thinking foods were safe to eat that weren’t. Other alterations included swapping menu fonts for Wingdings and replacing the names of dishes with joke names. (“Shellfish” became “Hellfish,” for example.) As CNN notes, “Disney identified and removed all altered menus before they were shipped to restaurants.” Scheuer’s lawyer insists in a sentencing memorandum that Scheuer only made menu changes to get the company’s attention, as he believed he had been wrongfully fired over a mental health condition — he’d been let go after having a panic attack during a disagreement at work and requesting mental health accommodations, the lawyer says — but was having trouble finding an attorney to take his case or getting anyone at the company to respond to his concerns. But federal lawyers argued in their own sentencing memo that he made certain alterations discreetly, “specifically to avoid detection.” Along with messing with Disney’s menus, the US accused Scheuer of launching “serial denial-of-service attacks against fourteen individual employees, some of whom were involved in his termination,” by “simulating thousands of incorrect login attempts to thus lock them out.” He was also found outside the home of one of those employees after the FBI searched his home. Attorneys for the US agreed that Scheuer’s actions were driven, at least in part, by “a mental health episode.”