Walt Disney World Resort
Walt Disney World menu-system intrusion
Summary
A former employee’s 2024 intrusions disrupted Walt Disney World Resort’s menu production and locked staff out of work accounts. Court records confirm deliberate menu changes and continued manual workflows, followed by a guilty plea and prison sentence.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
-
Credential compromise
Theft, exposure, or abuse of user or administrator credentials.
-
Insider threat
Malicious or negligent actions by an authorized insider resulting in cyber impact.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data publication or leak
Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.
-
Data alteration or manipulation
Data was intentionally changed, falsified, manipulated, or otherwise modified without authorization.
-
Data corruption
Data became damaged, inconsistent, unreadable, or unreliable as a result of malicious activity or incident-related system effects.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Complete service outage
A primary service, system, platform, or operational capability became entirely unavailable.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Authentication disruption
Users were unable to authenticate, sign in, access accounts, or use identity-dependent services.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Safety risk or operational hazard
The disruption created or increased a risk to physical safety, public safety, patient safety, industrial safety, or safe operations.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
Analyst assessment
DysruptionHub assesses with high confidence that a former employee conducted unauthorized intrusions and account-lockout attacks affecting Walt Disney World Resort’s menu production and staff access in 2024. Michael Scheuer admitted the conduct in a federal plea agreement and was subsequently sentenced to three years in prison.
The admitted conduct occurred over an approximate June-to-September period. The factual basis identifies creation of an unauthorized administrator account on July 3 and changes to menu files the next day. Shared credentials known from Scheuer’s former job allowed access after his authorization ended. Password resets restricted the menu application, but separate vendor-managed file-transfer servers were also accessed.
Operational significance
Changes to fonts and menu backgrounds made menus unusable and disrupted the Menu Creator application for one to two weeks. The company restored older files and manually brought menus up to date. The January 2025 factual basis said the application was no longer used and a manual approval and distribution process remained in place while a replacement was developed.
Menu alterations included false allergen information and changed QR-code destinations. The court records say affected printed menus were identified and isolated before being sent to restaurants. They do not establish that customers received the false allergen information or were injured.
Separate attacks repeatedly locked 14 employees out of enterprise accounts used for email and other work. The factual basis says those attacks stopped Sept. 23, 2024, and had not restarted after investigators seized Scheuer’s computer. Scheuer also admitted publishing menu-system access information online.
Confidence and uncertainty
Confidence is high in the unauthorized access, deliberate data alteration and documented workflow disruption because the admitted factual basis corroborates the original FBI affidavit. Original reporting identified the otherwise unnamed employer as Disney through attorney corroboration. The Justice Department’s sentencing announcement confirms the conviction and $687,776.50 restitution order. That amount is distinct from an earlier damage estimate and is not evidence of a ransom.
The documented conduct is insider sabotage and account denial of service. The public record does not establish ransomware or extortion. The account-lockout attacks are not described here as a distributed denial-of-service campaign.
Analytic gaps
The incident is presumed resolved, but the public record does not establish when the replacement menu system was completed or manual workflows ended. The third-party vendor remains unnamed in the reviewed court documents. The scope of any subsequent use of the published login information is also unestablished.
Organizations involved
Impacted locations
Bay Lake, Florida
Official BayLake city About page states all four resort themeparks and several hotels lie within BayLake. This maps an affected business’s operating place; it does not assert all restaurants were disrupted, that unsafe menus reached customers, or that the citygovernment was compromised. Menu-production and employee-access disruption established by original federal factual basis. No facility record or commercial jurisdictional overlay.
Lake Buena Vista, Florida
Current legal operator office1375BuenaVistaDrive and official resort contact location. ExactCensus confirms actual LakeBuenaVista municipality, not Orlando postal/metropolitan shorthand. Current corporate address changedMar2025, not proof of2024office occupancy. City official About page independently locates DisneySprings/hotels within this municipality. Menu-production and employee-access disruption established by original federal factual basis. No facility record or commercial jurisdictional overlay.
Sources
We reported unauthorized menu changes, disruption to menu production and employee account lockouts following a former employee’s termination.
Original reporting identifies Disney through corroboration with Scheuer’s lawyer and the filing. Altered menus were intercepted before restaurant distribution.
The admitted factual basis confirms menu tampering, continued manual menu approval and distribution, employee-account lockouts and publication of menu-system login information.
Prosecutors confirm a guilty plea to unauthorized computer damage and aggravated identity theft, including allergen-menu changes and employee account denial of service.
The court imposed three years in federal prison, computer forfeiture and $687,776.50 in restitution for computer damage and aggravated identity theft.
The FBI affidavit describes unauthorized menu-system access, one to two weeks of application disruption, manual alternatives, menu alteration and employee account lockouts.
See something that needs correction?
Signed-in members can report an error, update, or missing source.