US newspaper publisher uses linguistic gymnastics to avoid saying its outage was due to ransomware – Source: go.theregister.com

US newspaper publisher Lee Enterprises is blaming its recent service disruptions on a “cybersecurity attack,” per a regulatory filing, and is the latest company to avoid using the dreaded R word.

Listed companies have become adept at describing ransomware without actually saying the word in recent times, Lee being one of them. It told the Securities and Exchange Commission (SEC) that “threat actors unlawfully accessed the company’s network, encrypted critical applications, and exfiltrated certain files.”

That sounds an awful lot like double extortion ransomware to us.

The details on offer in today’s Form 8-K are the first that provide a strong signal the chain of events were due to ransomware, as was suspected when the troubles were first officially disclosed on February 7. Lee had previously told regulators a “cyber incident” was to blame for a “technology outage.”

Lee’s 8-K, filed on Friday but published today, went on to state that the full extent of the attack was still being assessed. 

Forensic analyses remain ongoing to determine if any sensitive data or personally identifiable information (PII) was compromised during the breach, but the company said that as of February 12, the period to which the filing relates, “no conclusive evidence has been identified.”

The impact of the attack has spread across various business operations, and no known cybercrime group has yet claimed responsibility.

Product distribution, billing, collections, and vendor payments were all confirmed to have been affected, and the company echoed the details provided by its own newspapers regarding the production delays hitting digital and print editions.

“As of February 12, 2025, all core products are being distributed in the normal cadence, however weekly and ancillary products have not been restored,” the filing reads. “These products represent 5 percent of the company’s total operating revenue.”

Lee said the phased recovery will continue over a period of several weeks and that the exploit is likely to have a material impact on its future financials.

In the meantime, temporary measures such as manual transaction processing and shifting to alternative distribution channels have been enacted to ease the burden of business-critical functions.

“Lee maintains a comprehensive cybersecurity insurance policy, which covers costs associated with incident response, forensic investigations, business interruption, and regulatory fines, subject to policy limits and deductibles.”

“The company will provide updated guidance once a full assessment is completed.”

Many of Lee Enterprise’s news brands still have a banner sprawled across their web pages warning of the impact.

“We are currently undergoing maintenance on some services, which may temporarily affect access to subscription accounts and the E-edition,” reads the top of the Daily Progress, and others. “We apologize for any inconvenience and appreciate your patience as we work to resolve the issues.”

Lee Enterprises operates across 25 states, publishing more than 70 daily newspapers and nearly 350 weekly and special-interest publications.

• Ransomware isn’t always about the money: Government spies have objectives, too
• Triplestrength hits victims with triple trouble: Ransomware, cloud hijacks, crypto-mining
• Someone is slipping a hidden backdoor into Juniper routers across the globe, activated by a magic packet
• FortiGate config leaks: Victims’ email addresses published online

Many of its newspapers delayed their print editions for days at a time when the attack first took hold, apologizing to their readers, and promising that editions would be delivered albeit a little late and in some cases in a smaller format.

Where there weren’t total delivery delays, some productions reduced in size from three sections to two. The Arizona Daily Star was one such example of a publisher that had to reduce its output to meet print deadlines – it said processes that were usually automated had to be completed manually. 

Lee’s CEO Kevin Mowbray thanked the company’s journalists for working through the trying period, demonstrating “above-and-beyond efforts to continue reporting the news and maintaining our operations under challenging circumstances.” ®