Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Lee Enterprises experienced a cyberattack beginning February 3, 2025, that encrypted critical applications and exfiltrated certain files. The outage disrupted newspaper distribution, online operations, billing, collections and vendor payments. Lee did not initially call it ransomware, but encryption combined with file exfiltration fits the common technical description of a double-extortion ransomware attack.
What happened and when
Lee disclosed the incident in a February 12, 2025 SEC filing. The company said attackers unlawfully accessed its network, encrypted critical applications and exfiltrated certain files. Lee activated its incident-response plan, bringing in internal personnel and outside cybersecurity specialists.
| Date | What Lee or outside reporting established |
|---|---|
| February 3, 2025 | Lee experienced a systems outage caused by a cybersecurity attack. |
| February 12, 2025 | Lee disclosed network access, application encryption and file exfiltration. It also described disruption to distribution, billing, collections and vendor payments. |
| February 12, 2025 | Core products had returned to their normal distribution cadence; weekly and ancillary products remained disrupted and represented about 5% of operating revenue at that point. |
| March 6, 2025 | In a filing amendment, Lee said the threat had been contained and that third-party security vendors were helping restore automated business processes. |
| September 28, 2025 | Lee’s fiscal year ended. Its later annual report quantified the incident’s fiscal-2025 cash-flow impact. |
| December 28, 2025 | Lee continued to describe the event as affecting IT systems and files, with legal and forensic review ongoing. |
How the attack disrupted newspaper operations
The outage affected the publishing workflow rather than only newspaper websites. Lee reported interruptions involving:
- Print distribution and delivery scheduling
- Online operations
- Subscriber billing and payment collection
- Vendor-payment processes
- Automated business processes being rebuilt with third-party security vendors
Local reports described smaller-than-usual editions, missing regular features and limits on late-breaking coverage at some properties. The severity varied across Lee’s portfolio, which included dozens of local newspapers and related products; the available evidence does not establish that every title was affected in the same way. Axios reported on effects at properties including the Richmond Times-Dispatch, while Lee’s SEC filings provide the company-wide operational description.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Why the incident is described as ransomware
Lee’s formal filings used “cybersecurity attack” or “cybersecurity incident,” not the word ransomware. Nevertheless, encrypting business applications while removing files is characteristic of modern double-extortion ransomware: criminals disrupt operations with encryption and create leverage by threatening to publish stolen data.
SecurityWeek characterized the event as ransomware based on those disclosed behaviors. Reports later said the Qilin ransomware group claimed responsibility, but that attribution came from external reporting and was not established as fact by Lee’s filings. There is also no verified public evidence in the cited disclosures that Lee paid a ransom.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Recovery was phased, not a single restoration date
By February 12, Lee said its core products were again distributed on their normal cadence. That milestone did not mean every product or business system was operating normally: weekly and ancillary products were still disrupted, and Lee anticipated a phased recovery over the following weeks.
The March 6 filing said the threat was contained and that vendors were helping restore automation. Lee’s fiscal-2025 annual report later said remediation and restoration continued, delayed projects and affected operating results. No cited filing establishes a date on which every affected system and product was fully restored.
Recommended Free Tools
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
What is known about stolen data
Lee confirmed that certain files were exfiltrated. In its initial disclosure, however, the company said its forensic work had not yet conclusively determined whether sensitive information or personally identifiable information had been compromised.
In a filing covering the period ended December 28, 2025, Lee said it had offered identity-protection services to affected customers and subscribers and that legal and forensic review continued. That offer does not prove that every subscriber’s sensitive information was stolen, nor does the available record establish that no personal information was involved. Lee’s December 2025 filing is the latest relevant disclosure identified here.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Financial consequences for Lee
Lee’s fiscal-2025 Form 10-K reported the following incident-related amounts for the year ended September 28, 2025:
| Amount | What it represents |
|---|---|
| $10.5 million | Disclosed cash-flow impact associated with the cyber incident during fiscal 2025. |
| $3.7 million | Expenses recognized in “Restructuring and Other.” |
| $6.8 million | Amount for which Lee filed insurance claims for business-interruption and other costs. |
| $500,000 | Cyber-insurance deductible. |
The $10.5 million is not a ransom figure, a guaranteed lifetime cost or a complete measure of lost revenue. Lee said the incident adversely affected fiscal-2025 operating results, but that its incremental effect on revenue and some operating expenses could not be cleanly separated from other business factors. Filing an insurance claim also does not establish that the full $6.8 million was ultimately reimbursed.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsBest Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Why a newspaper cyberattack reaches beyond the newsroom
Local publishers depend on interconnected systems for content management, advertising, subscriber records, billing, payment processing, pagination, print scheduling and delivery logistics. An outage in one layer can make a newspaper smaller, later or harder to pay for even when journalists and printing equipment remain available.
Lee’s annual report said it operated 14 print sites for most daily newspapers and that three dailies were printed by third-party printers. It also described formal or informal backup-printing arrangements. Those contingencies can provide alternatives when production capability is disrupted, but they did not prevent this incident from affecting distribution and back-office processes.
What remains unresolved
As of Lee’s filing for the period ended December 28, 2025, several questions remained open:
- Whether forensic work had identified every affected file or individual
- Whether any ransom was paid
- Whether Qilin or another actor could be conclusively attributed to the intrusion
- Whether all insurance claims would be recovered
- What long-term technology and control changes Lee would make
The clearest established account is therefore narrower than some headlines: Lee suffered a February 2025 cyberattack involving application encryption and file exfiltration, producing a ransomware-like operational shutdown across parts of its newspaper and business systems. Core distribution recovered first, while other products and automation took longer, and the company reported a $10.5 million fiscal-2025 cash-flow impact.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
