Lee Enterprises admits to ransomware attack causing disruptions for more than 14 days

Lee Enterprises has confirmed that a ransomware attack disrupted operations across its newspaper network for more than two weeks. The company, known for publishing 77 daily newspapers and 350 weekly and speciality publications across 26 US states, revealed details of the incident through a regulatory filing with the US Securities and Exchange Commission (SEC).

The cyberattack, which began on 3 February, caused a significant systems outage within Lee Enterprises. It was determined that cybercriminals gained unauthorized access to the company’s network, encrypted key applications, and exfiltrated certain files. While a forensic investigation is ongoing to assess the potential compromise of sensitive data or personally identifiable information (PII), no concrete evidence of exposure has been confirmed as of yet.

This attack impacted various core functions of Lee Enterprises’ operations, including newspaper printing, distribution, billing, collections, and vendor payments. Internal system accessibility was hindered for employees, and newsroom operations faced disruptions due to VPN connectivity issues. Consequently, some newspapers experienced delays in print editions, and digital services were only partially available, prompting notifications to subscribers regarding possible disruptions.

As of 12 February, Lee Enterprises reported that its major publications had resumed their usual distribution schedules, but certain weekly and speciality publications, contributing about 5% of the company’s total operating revenue, were still inaccessible. The company anticipates a phased recovery process in the upcoming weeks.

In response to the breach, Lee Enterprises mobilized its incident response team, consisting of internal personnel and external cybersecurity specialists. Temporary measures were implemented to sustain critical business activities, including manual transaction processing and alternative distribution methods. Law enforcement agencies and regulatory bodies were promptly informed about the incident to ensure appropriate action is taken.

Publications such as the St. Louis Post-Dispatch, Omaha World-Herald, Buffalo News, Richmond Times-Dispatch, Arizona Daily Star, and Casper Star-Tribune were affected by the attack. Access issues were reported by employees in these newsrooms, leading to initial difficulties in page-building and content publication due to network disturbances.

The financial implications of the attack remain uncertain but are expected to be substantial, according to Lee Enterprises. The company holds a cybersecurity insurance policy aimed at covering expenses associated with forensic investigations, incident response, business interruptions, and regulatory penalties, subject to policy limits and deductibles. Efforts to investigate the attack and restore affected systems are actively underway.

This incident adds to previous cyber incidents targeting Lee Enterprises, such as Iranian hackers reportedly accessing the company’s content management system in 2020 as part of a disinformation campaign before the US presidential election. The recent ransomware attack underscores the growing concerns around cybersecurity risks confronting media organizations.