More than 75 Lee Enterprises newspapers affected by cyberattack

A ransomware gang took credit on Feb. 27, 2025, for a cyberattack that has for the last month disrupted operations at nearly 80 newspapers owned by Iowa-based Lee Enterprises, SecurityWeek reported.

The Feb. 3 cyberattack involved unauthorized access to critical applications and the withdrawal of files, disrupting the outlets’ ability to publish online or print publications, as well as subscribers’ access to their accounts.

As of March 4, affected newsrooms continued to display a banner atop their websites alerting readers to ongoing “maintenance” that may impact account access and the e-editions.

More than three weeks after the attack, Russia-linked ransomware group Qilin claimed responsibility for the attack and the theft of 350 GB of data in a post on its website. According to SecurityWeek, the announcement suggests that Lee refused to pay the ransom or that negotiations have stalled.

“All data will be published on March 5, 2025,” the post said. “The documents we hold about Lee Enterprises reveal details worth noting—investor records, financial arrangements that raise questions, payments to journalists and publishers, funding for tailored news stories, and approaches to obtaining insider information.”

In a statement shared with the U.S. Press Freedom Tracker, a spokesperson for Lee said, “We are aware of the claims and are currently investigating them.”

Newspaper publisher Lee Enterprises alerted the Securities and Exchange Commission on Feb. 18, 2025, that an earlier cyberattack on the media company involved unauthorized access to critical applications and the withdrawal of files.

At least 79 Lee newspapers experienced disruptions to their online or print publications as a result of the Feb. 3 cyberattack. Some papers also reported that subscribers were unable to access their accounts or that their newsroom phone systems were disabled.

Most of the newspapers continued to have banners on their websites advising subscribers of “maintenance on some services, which may temporarily affect access to subscription accounts and the e-edition.”

According to the SEC filing — dated Feb. 14 but filed days later — unidentified actors “unlawfully accessed the Company’s network, encrypted critical applications, and exfiltrated certain files.

“The incident impacted the Company’s operations, including distribution of products, billing, collections, and vendor payments. Distribution of print publications across our portfolio of products experienced delays, and online operations were partially limited,” the filing said. “As of February 12, 2025, all core products are being distributed in the normal cadence, however weekly and ancillary products have not been restored.”

Lee added that it expects to restore remaining products in phases over the coming weeks and is still actively conducting a forensic analysis to determine whether sensitive data or personally identifiable information was compromised. The agency has alerted law enforcement and said it will notify relevant federal and state regulatory bodies, and applicable consumer protection agencies, as needed.