File: Guests dine at the Great Maple Restaurant at the Pixar Place Hotel at the Disneyland Resort in Anaheim, CA.
Paul Bersebach | Medianews Group | Getty Images
An ex Disney employee agreed to plead guilty in a federal criminal case in which he is accused of hacking into the company’s restaurant menu creation software to falsely indicate that certain food items did not contain potentially deadly allergens such as peanuts, a court filing shows on friday.
Michael Scheuer is also accused of making other changes to Disney restaurant menus, including changing fonts, making some pages blank and changing information about wines to replace geographic regions with the locations of “recent mass shootings.” “, the file says.
In one case, Scheuer added “a swastika” to a menu, according to the plea agreement filed in U.S. District Court in Orlando, Florida. He has agreed to plead guilty to two felony counts – computer fraud and aggravated identity theft.
Court Watch news site first reported the plea deal.
The changes he made to allergen information on menus “focused on peanut, tree nut, shellfish and dairy allergens,” according to the filing.
“Scheuer added notes to menu items that indicated they were safe for people with specific allergies, changing which could have had fatal consequences depending on the type and severity of the customer’s allergy,” the filing states.
Although it is believed that “some numbers” of the changed menus were eventually suppressed, “it is believed that all of the changed menus were identified and isolated before they were sent” to Disney restaurants.
The plea agreement states that Disney no longer uses the third-party menu creation app that Scheuer hacked. The company “has switched to a manual menu approval and distribution process while a new system is developed.”
Scheuer was fired as menu production manager last June.
In August, the plea agreement says, Scheuer launched a cyberattack “designed to repeatedly lock out” Disney employees from their company online accounts.
Many of the 14 employees targeted in the so-called denial-of-service attack had some sort of interaction with Scheuer when he worked at the company.
Federal agents raided Scheuer’s residence on Sept. 23, the filing said. The denial-of-service attacks stopped minutes before agents first contacted him and did not resume after his computer was seized, according to the filing.
A criminal complaint filed in October accused him of accessing menu-creation software after his work had ended and making changes to Disney restaurant menus over a three-month period.
About a month after the raid, Scheuer traveled to the residence of one of the targets of the DOS raid, the plea agreement said. Scheuer is seen on security camera footage parking in front of the target’s home at night, walking up to the front door, inspecting the tag on a package outside the door and then “thumbs up the camera” before getting back into the car his. it said in the file.
“The incident resulted from Scheuer receiving notice earlier in the day of a search warrant previously executed by federal agents on his Google account,” the plea agreement said.
Because of that incident, Disney provided security to the victim of the incident, which included removing him from his home and placing him in a hotel, the filing said.
Scheuer’s attorney, David Haas, told CNBC that his client will plead guilty in the coming weeks.
“Mr. Scheuer is prepared to accept responsibility for his conduct,” Haas said. “Unfortunately, he has mental health issues that worsened when Disney fired him after returning from paternity leave.”
“No one was at risk of injury and he is deeply remorseful for what happened.”
Haas said Scheuer was fired after opposing changes to the company’s restaurant menu system.
Haas said Scheuer will be subject to a restitution order and fine when he is sentenced. The amount of monetary loss to Disney, which has not yet been determined, will affect the recommended prison time range for him.
