Skip to content

Standard-Examiner and Daily Herald delays precede Qilin claim

Summary

Standard-Examiner logo

The Standard-Examiner in Ogden and Daily Herald in Provo, both owned by Ogden Newspapers, reported significant production difficulties that disrupted Monday and Tuesday newspaper printing and delivery in early April 2026 while their digital editions remained available. Qilin later listed only the Standard-Examiner on May 2, but neither newspaper has confirmed ransomware, data theft or a connection between the claim and the shared printing disruption.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

DD-CIT assessment

Only external sources publicly identify the event as cyber-related. The organization publicly documents the resulting service disruption.

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Manufacturing or production disruption

    Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Customer or public access restricted

    Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Public leak threat

    The actor explicitly threatened to publish or publicly release victim data or incident details.

Incident narrative

Analyst assessment

DysruptionHub’s published report documented that the Standard-Examiner reported significant production difficulties on April 6, 2026, affecting Monday and Tuesday newspaper printing and delivery. The newspaper directed readers to its digital edition while it worked to resume normal production.

The Daily Herald, a separate Provo newspaper also owned by Ogden Newspapers, issued a substantially identical notice and directly confirmed that its own Monday and Tuesday printing was affected. DysruptionHub therefore treats the Daily Herald as a second, non-primary operational victim of the shared production disruption. The evidence does not establish which parent-company system, printing dependency, vendor or facility produced the common impact.

Separately, DysruptionHub assesses with low confidence that the production disruption was connected to malicious cyber activity. Qilin listed “STANDARD-EXAMINER” on its leak site on May 2 and threatened release of sensitive data unless negotiations occurred, but the newspaper has not confirmed ransomware, data theft, extortion or any relationship between the claim and the April production problems. The claim did not name the Daily Herald and should not be extended to it.

Operational significance

The confirmed impact was interruption to physical newspaper production and delayed delivery to readers in northern Utah and Utah Valley. Both publications said printing for two publication days was affected while their digital e-editions remained accessible. This reduced the operational scope compared with a complete publishing outage but still disrupted a core product and subscriber service at two separate newspapers.

The matching notices and shared ownership support a common production dependency or parent-company service issue. The public record does not identify the affected equipment, software, network, vendor, printing plant or corporate service, and it does not establish that either newsroom’s digital publishing systems were impaired.

Disclosure posture

Both newspapers publicly documented the operational disruption but described it only as production difficulties. Neither characterized the event as a cyberattack, security incident or ransomware event, and neither disclosed whether newsroom, printing, subscriber, advertising or corporate systems were affected.

The Qilin listing appeared almost a month later and named only the Standard-Examiner. DysruptionHub contacted the Standard-Examiner but did not receive a response by its reporting deadline. The absence of confirmation means the leak-site claim must remain analytically separate from the organization-documented printing disruption and cannot be used to attribute impact at the Daily Herald.

Confidence and uncertainty

Confidence is high that both newspapers’ printing and delivery were disrupted because each published a direct notice to readers. Confidence is low that Qilin caused the disruption or obtained Standard-Examiner data because the claim has not been corroborated by the victim, technical evidence, a breach notice or independent verification.

The public record does not establish ransomware encryption, a ransom demand delivered directly to either newspaper, data theft, publication of data, payment or continuing unauthorized access. Qilin’s identity is resolved in the registry, but resolving the actor record does not confirm responsibility for this incident.

Retrospective note

The newspapers said normal production would resume as soon as possible, and later published issues demonstrate that publication resumed. No direct restoration notice reviewed for this record documented when the shared production problem ended. DysruptionHub therefore retains presumed_resolved rather than positively confirming a restoration time.

Analytic gaps

The reviewed sources do not establish the cause of the production difficulties, the initial access vector, affected systems, malware family, encryption scope, data-exposure scope, ransom amount, payment status or final restoration date. They also do not identify the shared printing or technology dependency and do not determine whether Qilin’s May listing referred to the April production delays.

Threat actor and claim

Listed as: STANDARD-EXAMINERSource: otherPublished: Discovered:

Claim details

Qilin listed the Standard-Examiner and threatened publication of allegedly stolen data. The newspaper has not confirmed the claim or linked it to April production delays.

Organizations involved

Impacted locations

Sources

Standard-Examiner Utah printing delays followed by Qilin ransomware claim

DysruptionHub reported that the Standard-Examiner documented April print-production and delivery delays before Qilin listed the newspaper on May 2. The newspaper had not confirmed ransomware, data theft, or a connection between the two events.

Standard-Examiner continues to work through production delays; delivery disrupted

The Standard-Examiner said significant production difficulties affected Monday and Tuesday newspaper printing and delayed delivery. It directed readers to the digital e-edition and said normal production would resume as soon as possible.

Daily Herald continues to work through production delays; delivery disrupted

The Daily Herald, a sister publication also owned by Ogden Newspapers, published a nearly identical notice saying significant production difficulties affected Monday and Tuesday printing while a digital edition remained available.

Qilin Ransomware Strikes Standard-Examiner

DeXpose reported that Qilin listed the Standard-Examiner on May 2 and threatened to release sensitive data unless negotiations occurred. The claim was not confirmed by the newspaper.

Contact Us

The Daily Herald identifies its office at 1200 Towne Centre Boulevard, Suite 1058, Provo, Utah 84601 and provides its publication contact information.

See something that needs correction?

Signed-in members can report an error, update, or missing source.