Lee Enterprises Data Breach

Summary

A ransomware attack on Lee Enterprises in February 2025 compromised the personal data of nearly 40,000 individuals. The stolen data includes names and Social Security numbers, exposing affected individuals to potential identity theft and fraud. Lee Enterprises is offering free credit monitoring and identity protection services to those affected.

Dont let data threats slow you downTrueNAS offers enterprise-level protection.

** Main Story**

Lee Enterprises, a major US publishing giant, disclosed a data breach affecting nearly 40,000 individuals. The breach resulted from a ransomware attack in February 2025, impacting current and former employees. The stolen data includes names and Social Security numbers, increasing the risk of identity theft for those affected.

The Ransomware Attack and Data Breach

The ransomware attack, which occurred on February 3, 2025, caused significant disruptions to Lee Enterprises’ operations. The attack encrypted crucial applications and resulted in the exfiltration of sensitive data. Initial reports of the attack surfaced when newsrooms across the US experienced system outages, impacting printing and delivery of numerous newspapers. The company later confirmed in an SEC filing that hackers had encrypted applications and stolen data. The Qilin ransomware gang claimed responsibility for the attack, asserting they stole 350 GB of data encompassing 120,000 documents.

Data Exposed and Potential Impact

The compromised data includes first and last names combined with Social Security numbers, which is classified as highly sensitive personal data. Samples of the stolen data, including government ID scans, financial spreadsheets, contracts, and non-disclosure agreements, appeared on the dark web. The potential consequences for affected individuals are severe, ranging from identity theft and financial fraud to phishing scams. Criminals can exploit this information to open fraudulent accounts, apply for loans, or file taxes under the victims’ names. The exposed data could also be used to craft targeted phishing attacks aimed at gaining access to further sensitive information.

Response and Mitigation

Lee Enterprises launched an investigation immediately after discovering the breach and engaged third-party cybersecurity experts to assess the situation. The investigation, completed around May 28, 2025, confirmed the data breach and identified the affected individuals. Lee Enterprises has notified those affected by the breach and is offering them 12 months of free credit monitoring and identity protection services. The company has stated it has found no evidence of the misuse of the stolen information but has advised affected individuals to remain vigilant and take necessary precautions to protect their identities. Lee Enterprises also reported to authorities, including the Maine Attorney General’s office, and is cooperating with law enforcement in their investigation.

Broader Implications and Lessons Learned

The Lee Enterprises data breach highlights the increasing threat ransomware attacks pose to organizations of all sizes. These attacks are particularly damaging due to the dual threat of data encryption and data exfiltration. The incident underscores the importance of robust cybersecurity measures, including regular data backups, strong access controls, and employee training to recognize and avoid phishing attempts, a common entry point for ransomware. The breach also reinforces the need for incident response plans to minimize damage and ensure a swift recovery in the event of an attack. While Lee Enterprises has recovered its core operations, the incident’s financial impact is considerable, with a reported $2 million spent on recovery efforts. It also illustrates the risk to employee data, especially in the wake of previous job cuts, and the potential exposure of former employee information.