Fired Disney employee will plead guilty to hacking menus to hide peanut content

File: Guests eat at Great Maple Restaurant at the Pixar Place Hotel at the Disneyland Resort in Anaheim, CA.

A former Disney employee agreed to plead guilty in a federal criminal case where he is accused of hacking into menu-creation software for the company's restaurants, to falsely indicate that certain food items did not contain potentially deadly allergens such as peanuts, a court filing Friday shows.

Michael Scheuer is also accused of making other changes to Disney restaurant menus, including altering fonts, causing some pages to be blank and changing information about wines to replace geographic regions with the locations of "recent mass shootings," the filing says.

In one instance, Scheuer added "a swastika" to a menu, according to the plea agreement filed in U.S. District Court in Orlando, Florida. He has agreed to plead guilty to two felony counts — computer fraud and aggravated identity theft.

The Court Watch news site first reported the plea agreement.

The changes that he made to allergen information on menus "focused on peanut, tree nut, shellfish, and milk allergens," according to the filing.

"Scheuer added notations to menu items indicating they were safe for people with specific allergies, which change could have had fatal consequences depending on the type and severity of a customer's allergy," the filing said.

Although it is believed that "some numbers" of the altered menus were ultimately printed, "it is believed that all altered menus were identified and isolated prior to being shipped out" to Disney restaurants."

The plea agreement says that Disney no longer uses the third-party menu creation application that Scheuer hacked into. The company "has moved to a manual menu approval and distribution process while a new system is developed."

Scheuer was fired as a menu production manager last June.

In August, the plea agreement says, Scheuer launched a cyberattack "designed to continually lock" Disney employees out of their company online accounts.

Many of the 14 employees targeted in the so-called denial-of-service attack had some kind of interaction with Scheuer when he worked at the company.

Federal agents raided Scheuer's residence on Sept. 23, the filing said. The denial-of-service attacks ceased minutes before agents first made contact with him, and did not restart after his computer was seized, according to the filing.

A criminal complaint filed in October accused him of accessing menu-creation software on the heels of his termination and making the changes to Disney restaurant menus over a three-month period.

About a month after the raid, Scheuer traveled to the residence of one of the DOS attack targets, the plea agreement said. Scheuer is seen on security camera footage parking in front of the target's home at night, approaching the front door, inspecting the label of a package outside the door, and then "giving a thumbs up to the camera" before walking back to his car, the filing said.