Skip to content
DysruptionHub
Sign in Subscribe

Lee Enterprises ransomware disrupts newspaper production

Summary

Lee Enterprises logo

A Feb. 3, 2025, ransomware attack disrupted Lee Enterprises’ newspaper distribution, online operations and financial workflows. Production resumed in stages while automation and back-office limitations persisted. The company confirmed file theft; Qilin’s specific claim remains unverified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
High
Attribution:
Low

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

  • Unauthorized access

    Unauthorized access to systems, accounts, networks, or data.

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data encryption

    Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Payment processing disruption

    The organization could not process, receive, issue, reconcile, or record payments normally.

  • Transaction processing disruption

    Business, financial, customer, administrative, or operational transactions could not be completed normally.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • Public leak threat

    The actor explicitly threatened to publish or publicly release victim data or incident details.

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Data sample published

    The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.

  • Countdown or payment deadline

    The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

Incident narrative

Analyst assessment

A ransomware attack disrupted Lee Enterprises’ newspaper and business systems beginning Feb. 3, 2025. In its initial material-incident filing, Lee said intruders unlawfully accessed its network, encrypted critical applications and exfiltrated files. A later company notice identified possible unauthorized file access or acquisition on Feb. 1, preceding the observed outage.

Operational significance

The interruption affected publication distribution, online operations, billing, collections and vendor payments. Lee used manual transaction processing and alternative distribution arrangements. By Feb. 12, core products had returned to their normal distribution cadence, but weekly and ancillary products had not been restored.

Effects varied among newspapers. The Arizona Daily Star’s notice said it continued printing and publishing an e-edition while using manual production processes and a smaller two-section format. Some other Lee newspapers missed print editions. The evidence does not establish identical outages at every publication in the company’s portfolio.

Lee’s March 6 update said the threat was contained and all products were being produced and distributed. Limitations remained: tighter schedules reduced product depth, back-office functions were delayed and automation was still being restored. Resumed distribution was therefore a partial recovery milestone.

The fiscal 2025 annual report reported $10.5 million in cyber-related cash-flow losses, including about $3.7 million in incurred expenses. Insurance recoveries were reported separately, including in 2026 financial results. These accounting consequences do not establish that systems remained unavailable throughout that period.

Confidence and uncertainty

Company filings support high confidence in encryption, file theft and operational disruption. Its June 5 data notice said potentially affected information included names with identity, financial, medical or insurance details, varying by person. It reported no evidence of misuse at that time.

Qilin claimed responsibility, alleging theft of 120,000 files totaling 350 gigabytes, displaying purported samples and threatening publication by March 5. Lee said it was investigating the claims. Its independently confirmed file theft does not verify the group’s identity, alleged volume or authenticity of every sample.

A July 31, 2026, court order approved a $600,000 settlement fund in the cyber-incident class action. The order described potentially compromised information belonging to approximately 39,779 people. This settlement is distinct from the company’s separate video-privacy litigation and does not establish Qilin’s identity or a ransom payment.

Analytic gaps

The entry route, exact final restoration date, ransom amount and payment outcome remain unverified. Operational status is presumed resolved; the reviewed record does not support a precise endpoint. Later litigation, insurance reimbursement and breach notification do not by themselves extend the outage. Financing relief and a separate video-privacy settlement are not ransom payments or losses attributable to this attack.

Threat actor and claim

Qilin

Listed as: Lee EnterprisesSource: ransomware.live; BleepingComputerDiscovered:

Claim details

A Qilin-attributed tracker listing names Lee Enterprises and lee.net. BleepingComputer’s Feb. 28, 2025, report describes the group’s allegation of 120,000 files totaling 350 gigabytes, purported document samples and a threat to publish by March 5. Lee said it was aware of the claims and investigating. The company’s independent confirmation of encryption and file exfiltration does not verify Qilin’s responsibility, the claimed volume or every sample. Tracker discovery on Feb. 27 precedes the report’s account of the listing on Feb. 28; the exact original claim publication time remains unverified.

Organizations involved

Impacted location

  • Davenport, Iowa

    Davenport is the verified physical headquarters municipality of the affected company. Lee’s filing documents disruption to corporate systems and business processes. This headquarters anchor does not describe the incident’s full reach or imply a citywide outage; affected-publication municipalities require their own evidence.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.