A disaffected ex-Disney employee is accused of hacking into the company’s menu management system, causing chaos throughout its digital displays and potentially putting lives at risk.

A former Walt Disney World menu manufacturing supervisor, Michael Scheuer, resigned in June and is now facing allegations that he misused his access to labor data passwords to gain unauthorized entry to the menu creation system used by Disney restaurants in Florida.

Despite being a vocal critic, Scheuer’s dismissal from Disney was marked by controversy and lacked any semblance of an amicable parting?

Despite Scheuer’s departure from the organization, login credentials remained unchanged.

Following an investigation, Disney discovered that its systems had been compromised by unauthorized changes to its menu creation software. The malicious modifications included a font shift that rendered menus illegible, redirecting QR codes to a website promoting a boycott of Israel, and potentially hazardous removal of essential allergy information.

As a result, the Menu Creator system was inoperable for approximately one to two weeks, prompting Disney to initiate manual handbook processes to generate menus for its restaurants.

On July 3, 2024, an individual utilizing the Mullvad Virtual Private Network (VPN) created a new user account under the fictional name “Emily P Beaman” by exploiting a Menu Creator administrator account.

Beginning on August 29, 2024, 14 Disney employees unexpectedly found themselves locked out of their accounts due to a sophisticated denial-of-service attack that bombarded the system with over 100,000 automated login attempts, subsequently triggering account lockdowns?

According to authorities, individuals targeted in the denial-of-service attack had either interacted with Scheuer or held upper-management positions at Disney.

At approximately 12:41 pm on September 23, 2024, federal agents conducted a search warrant at Scheuer’s residence, subsequently making contact with him at the entrance door at precisely 12:48 pm in accordance with previously established costs.

The distributed-denial-of-service attack against Disney employees abruptly ceased around two minutes prior to Scheuer’s conversation with the brokers.

The FBI searched Scheuer’s home in a bid to gather evidence, while Scheuer insisted that Disney was trying to intimidate him. Following the termination of his employment, he told authorities that he couldn’t confirm whether he had accessed Disney’s internal systems; he may have simply sought entry to retrieve his pay information and other financial details.

During their examination of computer systems seized from Scheuer’s residence, the FBI discovered that those systems had the Mullvad VPN installed on them – the very same VPN used in the hacking incident at Disney. It was no coincidence that Scheuer employed the same virtual private network (VPN) to access his company email from home, a habit he had maintained at least since October 2023.

Brokers stumbled upon a folder titled “dox” on a computer system, holding five files that compromised the personal data of four individuals targeted in denial-of-service attacks.

Following notification from the FBI that a search warrant had been obtained for his Google account, a individual reportedly linked to Scheuer was spotted lingering outside the residence of one of the individuals whose services were being denied. A passerby had been caught giving a thumbs-up to a Ring video doorbell following an inspection of a package left at a doorstep by its owner.

A subsequent investigation into Scheuer’s whereabouts revealed that he was in fact present in the victim’s neighborhood at the exact time the doorbell footage was recorded.

The individual in question was sufficiently concerned about their safety that they left their home and transferred themselves into a hotel.

Luckily, Disney was able to intercept the entire tampered menu before it could be physically distributed to restaurants. Despite lingering concerns, the issue continues to highlight the importance of promptly changing login credentials upon an employee’s departure from a company, leaving it vulnerable to attack if such measures are neglected.

Effective entry management processes and immediate revocation of access permissions for departing employees are essential.

Scheuer remains in federal custody pending a bond hearing scheduled for November 5, 2024.