According to a federal criminal complaint filed in Florida, former Disney employee, Michael Scheuer, has been accused of hacking into Disney restaurant software to falsely indicate that certain food items were peanut-free.

Scheuer, who was terminated in June for the alleged misconduct, was responsible for creating and publishing menus for Disney's entire restaurant portfolio. After his termination, he allegedly continued to access the menu software from a personal device, changing menu prices, adding profanity, and altering allergen information.

The FBI investigation concluded that Scheuer breached the company's software several times over three months. Scheuer denied any wrongdoing and claimed Disney was trying to frame him due to concerns surrounding the conditions of his termination. His attorney stated that no one was injured or harmed and that Scheuer has a disability that impacted his termination. Disney has not yet commented on the case. https://www.salon.com/2024/11/04/fbi-ex-disney-world-employee-accused-of-hacking-menus-altering-peanut-allergen-warnings/ (Nov. 04, 2024).

Commentary

The crimes allegedly committed include knowingly causing the transmission of a program to a protected computer and intentionally causing damage without authorization.

In addition to these crimes, had someone become ill from an allergic reaction because menus were altered, Disney would likely face civil complaints for negligence. Although a disgruntled ex-employee was primarily responsible, a likely argument would be that Disney was also negligent in allowing the disgruntled former employee the access and means to alter the allergy information on the menus.

In other words, had Disney performed its cybersecurity in a reasonable manner, the ex-employee would not have been able to hack the menus.

The employee's hacking of the menus could have led to an injury or death because of the risk peanut allergies present. Here are some key statistics:

• Approximately 6.2 million people in the United States have a peanut allergy. This includes both children and adults.
• Peanut allergies are one of the most common food allergies among children. The prevalence of self-reported peanut or tree nut allergy in children more than tripled between 1997 and 2008.
• One-third to one-half of those with peanut allergies may experience anaphylaxis, a severe and potentially life-threatening allergic reaction.
• In the United States, approximately 150 to 200 people die each year from food allergies, with 50% to 62% of these deaths attributed to peanut allergies.
• Sources: https://www.foodallergy.org/sites/default/files/2024-07/FARE%20Food%20Allergy%20Facts%20and%20Statistics_April2024.pdf, https://onlinelibrary.wiley.com/doi/pdf/10.1111/all.14666, and https://health.howstuffworks.com/diseases-conditions/allergies/food-allergy/peanut/how-many-people-die-each-year-from-peanut-allergies.htm

The final takeaway is that cybercrimes can quickly spin off into different forms of civil liability like breaches, privacy and, as this case illustrates, even negligent injury or wrongful death.

Jack McCalmon, Leslie Zieren, and Emily Brodzinski are attorneys with more than 60 years combined experience assisting employers in lowering their risk, including answering questions, like the one above, through the McCalmon Group's Best Practices Help Line. The Best Practice Help Line is a service of The McCalmon Group, Inc. Your organization may have access to The Best Practice Help Line or a similar service from another provider at no cost to you or at a discount. For questions about The Best Practice Help Line or what similar services are available to you via this Platform, call 888.712.7667.

If you have a question that you would like Jack McCalmon, Leslie Zieren, or Emily Brodzinski to consider for this column, please submit it to ask@mccalmon.com. Please note that The McCalmon Group cannot guarantee that your question will be answered. Answers are based on generally accepted risk management best practices. They are not, and should not be considered, legal advice. If you need an answer immediately or desire legal advice, please call your local legal counsel.