Ex-Disney Worker Who Hacked Menus Gets 3 Years in Prison

A former employee of Walt Disney World who hacked into menus used by its restaurants and edited them — changing prices, adding profanity and altering listed allergens — was sentenced to three years in prison by a federal judge in Florida this week.

None of the changes, including falsified information about food allergens that could have been harmful to visitors, ever appeared before the public, according to court records. The menu alterations were caught and court records show that none of the changes ever reached the printing stage.

The former employee, Michael Scheuer of Winter Garden, Fla., was sentenced on Wednesday in federal court in Orlando, Fla., after pleading guilty in January to one count of computer fraud and one count of aggravated identity theft.

Mr. Scheuer, 40, was ordered to pay restitution of about $620,000 to Disney and $70,000 to the unidentified software company that provides Disney with its menu creation program.

While court documents do not mention Disney World, menus that were entered into evidence in Mr. Scheuer’s case are from the hundreds of restaurants at Walt Disney World in Orlando.

Disney World representatives did not respond to messages seeking comment.

In early June 2024, Mr. Scheuer had returned from paternity leave, court documents show. A few days later, he had an argument with a supervisor about menu creation, according to the documents, and he was told that he would be suspended.

Instead, he was fired for unspecified misconduct, the documents state.

An investigation by the Federal Bureau of Investigation later revealed that, beginning around that time and over approximately the next three months, there were multiple hacks into servers that hosted the menu creation program.

Those changes included price cuts or hikes of a few dollars, profanities and altering allergens in certain items.

On a drink called the “Giddy-Up” — a blend of vodka, lemonade and iced tea — he lowered the price by $2, according to court records, and took two ounces off a 10-ounce filet mignon. In another instance, “shellfish” was changed to “hellfish.”

On a couple of menus, either the prices or the descriptions of the items disappeared.

He changed a wine region — Golden, Colo. — to the location of a mass shooting, Aurora, Colo. He also edited “Infamous Goose” — high-quality imported wine from New Zealand — to “Infamous Moose.”

More crucially, Mr. Scheuer edited certain menu items, falsely showing that they were safe for people with allergies to peanuts, tree nuts, shellfish and milk, according to his plea agreement.

Prosecutors said “the discreet way in which these changes were made was likely by design, specifically to avoid detection.”

But Mr. Scheuer’s lawyer, David Haas, said that his client had only been trying to get the attention of Disney so that it would respond to him.

“He knew the menu changes would be identified in Disney’s extensive menu review process,” Mr. Haas said in a court document.

Disney had indeed noticed, and it had contacted the F.B.I., identifying Mr. Scheuer as a possible suspect. In September, the F.B.I. executed a search warrant at Mr. Scheuer’s home and seized several electronic devices.

The criminal complaint also shows that Mr. Scheuer blocked 14 Disney employees from their company accounts through denial-of-service attacks. Some of the targeted workers were former colleagues involved in his firing, according to court records.

On one occasion, Mr. Scheuer drove to the home of one of the targeted employees shortly before 11 p.m., walked to the front door and gave a thumbs-up to the Ring doorbell camera before leaving, court records show.

Gregory W. Kehoe, the interim U.S. attorney for the Middle District of Florida, said that Mr. Scheuer’s actions were at least partly attributable to a mental health episode. Prosecutors asked for a 70-month sentence.

Mr. Haas said in an interview on Friday that “Mr. Scheuer remains remorseful and apologetic to his former co-workers,” adding that he was grateful to the judge for imposing only a 36-month sentence.

Sheelagh McNeill contributed research.