Lee Enterprises said a cybersecurity attack that began disrupting its newspaper operations in Virginia and elsewhere more than a month ago has been “contained” but that the company’s business processes are not yet back to normal.
Meanwhile, the Davenport, Iowa-based company’s sole lender will waive interest payments due in March in order to free up additional money as Lee continues to deal with the fallout from the attack.
Lee owns newspapers in Virginia and two dozen other states. In Virginia, its papers include those in Bristol, Culpeper, Charlottesville, Danville, Fredericksburg, Lynchburg, Martinsville, Roanoke, Richmond and Waynesboro.
In a Thursday filing with the U.S. Securities & Exchange Commission, the company (NASDAQ:LEE) reiterated its description of the Feb. 3 incident as a “cybersecurity attack by threat actors who unlawfully accessed the Company’s network, encrypted critical applications, and exfiltrated certain files.”
“As of the date of this filing and because of the Company’s remediation and other activities, the threat has been contained and the Company is working closely with third-party security vendors to restore automation of its business processes impacted by the Incident,” Lee said.
In the days immediately following the cyberattack, some newspapers were unable to deliver print editions on time. E-Editions, which are digital replicas of print editions, were missing their front pages and inside pages of local news, although some pages of puzzles and advertisements were available.
Customers’ access to online accounts and subscription services also was impacted.
“Currently all products are being produced and distributed, although some limitations remain including limited depth of products due to tightened schedules,” Lee said. “Additionally, certain back-office functions remain delayed including billing our clients, collections, and payments to vendors. We anticipate the business processes to be fully restored in the coming weeks.”
Forensic analysis continues
The company said its investigation into whether the perpetrators accessed personally identifiable information “remains ongoing” and that the company expects “a definitive answer in the next several weeks.”
Lee first publicly confirmed the Feb. 3 incident, calling it a “cybersecurity event,” in a story published online on Feb. 7 and in multiple print editions the following day. It provided more details in an SEC filing dated Feb. 14 and posted online Feb. 18.
On Feb. 28, the tech publication SecurityWeek reported that a Russian ransomware gang, Qilin, claimed responsibility for the attack and threatened to release 350 gigabytes of stolen data unless Lee paid a ransom by March 5.
Lee spokesperson Tracy Rouch did not respond to a message Friday asking Lee to confirm the ransom demand and whether stolen information has been released.
Lender waives interest payment
Lee has a $446 million loan from the Omaha, Nebraska-based conglomerate Berkshire Hathaway, which stems from Berkshire’s January 2020 sale of more than 75 daily and weekly newspapers to Lee plus its refinancing of Lee’s previous debt.
To provide Lee with extra liquidity “to fund the cybersecurity incident’s remediation efforts and other operations,” Berkshire will waive $3.7 million in interest payments that were due in March and roll it into the loan’s principal, Lee said in its SEC filing.
Lee said the full scope of the attack’s financial impact is unknown but said it will have a “material” impact on its operations.
“The Company maintains comprehensive cyber insurance coverage, including business interruption insurance, and anticipates costs in excess of a small retainer to be reimbursed by insurance,” Lee said.
Lee most recently reported quarterly earnings on Feb. 6, when it posted a first-quarter net loss of $16 million on $145 million of operating revenue. The company’s stock is down more than 40% this year.
Digital editions still affected
As of Friday, some of the company’s news websites continued carrying messages on their home pages saying “maintenance on some services” might “temporarily affect access to subscription accounts and the E-edition.”
Not all Lee newspapers publish a printed edition daily. In 2023, the Bristol, Culpeper, Charlottesville, Danville, Martinsville and Waynesboro papers joined about three dozen others in reducing their schedules to print only three days a week, on Tuesdays, Thursdays and Saturdays only. Those papers still offered a digital edition on other days.
For the past two weeks, the non-daily Virginia papers have been offering digital replicas of the Richmond, Roanoke or Lynchburg papers on Sundays, Mondays, Wednesdays and Fridays “while we recover from technical issues,” according to notices on those editions.