Newspaper publishing giant Lee Enterprises has confirmed that a ransomware attack has severely disrupted its operations for over three weeks, affecting print distribution, online access, billing, and financial systems. The attack, which began in early February, has forced many of Lee’s 72 daily newspapers and 350 weekly publications across 26 states to delay or cancel print editions. Some digital services remain limited, preventing subscribers from accessing online content.
In an official filing with the U.S. Securities and Exchange Commission, Lee revealed that threat actors had infiltrated its network, encrypted critical applications, and stolen files.
The company is still investigating whether sensitive personal data was compromised. While core publications have resumed printing, other products, such as weekly and specialty editions, remain unavailable, with full recovery expected to take several weeks.
Why It Matters: The attack on Lee Enterprises highlights the growing cyber threats faced by media organizations, particularly ransomware attacks that cripple essential infrastructure. With delayed newspaper deliveries, disrupted online platforms, and financial strain, Lee’s ability to serve its readers and advertisers has been severely impacted. If subscriber and financial data were compromised, the company could also face long-term legal and reputational consequences.
- Ransomware Attack Confirmed: Hackers infiltrated Lee Enterprises’ systems, encrypting critical applications and stealing files. This has significantly disrupted the company’s ability to function, affecting its ability to publish newspapers and manage essential business operations. The attack shares characteristics with other major ransomware incidents targeting media organizations.
- Severe Business Disruptions: The cyberattack has affected print distribution, billing, vendor payments, and subscriber access. Some newspapers were unable to publish for days, and online services have been intermittently unavailable. Lee has implemented temporary workarounds but continues to experience operational setbacks.
- Extended Recovery Period: The company expects that restoring its systems will take weeks, with a phased recovery approach in place. While core products are being delivered, weekly and ancillary publications remain impacted. Lee is prioritizing the restoration of essential business functions but warns of ongoing disruptions.
- Ongoing Investigation: Lee is conducting a forensic analysis to determine whether sensitive or personal data was compromised. So far, there is no conclusive evidence of data theft, but the company is working with cybersecurity experts and law enforcement. Customers and employees are being notified as the investigation progresses.
- Wider Implications: This attack is part of a growing trend of cyber threats targeting media organizations. Similar incidents have disrupted major news publishers, including The Guardian and Norwegian media giant Amedia. The breach highlights vulnerabilities in the news industry’s reliance on digital infrastructure.
