Ex-Disney Employee Sentenced for Hacking Restaurant Menus and Altering Allergen Information

On April 25, 2025, a former Disney employee faced the consequences of his actions after being convicted of hacking into the digital menus at various park restaurants and deliberately changing allergen information, a move that posed serious health risks to visitors with dietary restrictions.

Background

The incident was first detected when discrepancies appeared in the digital menu offerings at several eateries within the Disney parks. Initially attributed to a system malfunction, further investigation revealed a deliberate attempt to tamper with allergen data. This was traced back to Jacob Sullivan, a disgruntled former IT specialist at Disney, who was terminated for unrelated reasons prior to the event.

Details of the Crime

Using credentials that had not been deactivated, Sullivan gained unauthorized access to the menu management system. Over the course of several weeks, he manipulated the allergen labels of food items—removing critical warnings about the presence of nuts, dairy, and gluten. His actions affected countless visitors, many of whom rely heavily on accurate menu descriptions to manage health issues related to allergies.

Legal Action and Sentencing

Once the source of the breach was identified, authorities arrested Sullivan. In court, he admitted to his wrongdoing, which he attributed to resentment towards his former employer. He was charged with cybercrime and endangering public health. Subsequently, the court sentenced him to three years in federal prison, coupled with a hefty fine and a directive to undergo professional counseling while in detention.

Implications and Response

Disney has since heightened its cybersecurity measures, conducting a comprehensive audit of their systems to ensure such an incident does not recur. The company also issued a public apology and extended their support to any guests who experienced health issues as a result of Sullivan’s actions.

Conclusion

The severity of Sullivan’s sentence reflects the increasing awareness and legal implications surrounding cybersecurity and public health safety. This incident serves as a stern reminder of the potential human cost of data breaches, not just in terms of personal data loss but also impacting physical well-being.