Welcome to the First Column IT Tech Blog

HomeBlog
The Disney Menu Debacle Can Teach Your Business a Lesson About Access Control

The Disney Menu Debacle Can Teach Your Business a Lesson About Access Control

November 25, 2024

The Disney brand centralizes its efforts on magic and wonder, but its parks’ food is one aspect that has recently been subject to concerning developments. A former Disney employee managed to access a menu-planning app and make changes to prices, add foul language, and change menu information. Since we live in a world with food allergies, you can already see where this is going.

The Federal Bureau of Investigation has issued this statement on the matter:

“The threat actor manipulated the allergen information on menus by adding information to some allergen notifications that indicated certain menu items were safe for individuals with peanut allergies, when in fact they could be deadly to those with peanut allergies.”

Thankfully, Disney nipped the issue in the bud before the menus were distributed, and there is no evidence that customers ever saw them. Additionally, there is no indication that these events are related to a prior event in 2023 when a death occurred at a Disney-owned restaurant due to allergens.

These Changes Could Have Been Prevented

This problem stems from a simple issue with network security: someone had permission when they shouldn’t have.

The FBI has reported that the accused individual, a former Disney employee and menu production manager named Michael Schuer, used his Disney credentials to access the menu-planning app to make changes. He was also able to use his old logins to access the app developer’s server. It’s a real case of a former employee doing despicable things with old login credentials.

What gave the “hack” away was the use of the Wingdings font. This is when Disney employees caught the issue and pulled the app. Before this, though, many employee accounts had been locked because the accused used scripts to automate logins. More than a dozen accounts exceeded their allowed login attempts, which made logging in difficult.

The complete criminal complaint offers more details about this event and the inciting attacks.

Pay Attention to User Permissions and Access Logs for Suspicious Activity

It might be a bit blunt of us to say, but this entire situation could (and should) have been prevented.

When an employee leaves your business or organization, you take away their login credentials right as they walk out the door. This is a standard and accepted best practice. It’s a part of ensuring proper access control for your business.

It’s easy to overlook a user’s profile when they leave your business, but you never know what baggage they’re leaving with—baggage that might cause them to lash out in unanticipated ways. We recommend that you practice the Principle of Least Privilege, where you only grant access as needed. There’s no reason that anyone who leaves your business should retain access to data, anyway, and the fewer entry points to your system for hackers (and other potential threats), the better.

To shore up your defenses and control access to your business, give First Column IT a call at (571) 470-5594.

Previous Post
May 9, 2025
Adjusting Your Business IT Approach Can Bring Greater Outcomes
Is your business technology a tangled web of frustrations? You're certainly not navigating this digital dilemma alone. We frequently hear from organizations grappling with sluggish networks, outdated software that feels like a relic from the dial-up era, and the ever-present anxiety of safeguarding crucial business data.
May 7, 2025
A Quick Introduction to the Drives in Microsoft Windows
Windows is, for the most part, the default operating system you can expect to see in a business setting. That said, some owners have never used a Windows computer before, instead using a simple Chromebook or a Mac. Still, it’s good to know how Windows works, especially since it seems there’s a significant gap in knowledge.
May 5, 2025
How Your Business Can Implement Better Cybersecurity Training Practices
Cybersecurity isn’t the most fun thing to talk about, but it’s still important. This is especially for your employees who are on the front lines, the most likely folks to encounter threats during their day-to-day tasks. Today, we want to cover how your business can build better cybersecurity training practices that can keep your business secure for the long haul.

Have a project in mind?

Start with our free consultation for VA, DC and MD companies. We will provide a detailed proposal and firm quote based on your specific IT support needs. All at a predictable monthly cost per seat.
Free Consultation - Sign Up Here