Business Context and Reporting Period
Company: LEE ENTERPRISES, Inc.
Filing Type: Form 8-K (Current Report)
Date of Report: February 12, 2025
Event Date: February 3, 2025
Context: The Company reported a material cybersecurity incident involving a systems outage caused by a cyberattack.
Key Financial Metrics and Operational Impact
Revenue Impact: The incident affected weekly and ancillary products, which represent approximately 5% of the Company's total operating revenue. Core products have resumed normal distribution.
Financial Condition: The full scope of the financial impact is not yet known, but the incident is reasonably likely to have a material impact on financial condition or results of operations.
Liquidity and Debt: The filing text does not provide specific values for revenue, profit, cash flow, margins, debt, or liquidity.
Insurance: The Company maintains a comprehensive cybersecurity insurance policy covering incident response, forensic investigations, business interruption, and regulatory fines, subject to limits and deductibles.
Material Changes and Incident Details
- Incident Nature: Threat actors unlawfully accessed the network, encrypted critical applications, and exfiltrated certain files.
- Operational Disruption: Impacted distribution of print publications, billing, collections, and vendor payments. Online operations were partially limited.
- Current Status: As of February 12, 2025, core products are distributed normally. Weekly and ancillary products remain disrupted.
- Data Breach Status: Forensic analysis is ongoing to determine if sensitive data or personally identifiable information (PII) was compromised. No conclusive evidence has been identified at this time.
Guidance, Outlook, and Risks
Outlook: The Company anticipates a phased recovery over the next several weeks. Temporary measures, including manual transaction processing and alternative distribution channels, are in place.
Guidance: Updated guidance will be provided once a full assessment is completed.
Risks and Contingencies:
- Ongoing forensic investigation to assess data compromise and financial impact.
- Potential regulatory fines and legal liabilities.
- Continued operational disruptions for non-core products.
Key Facts for Investor Verification
- Confirmation of whether sensitive data or PII was compromised during the exfiltration.
- The specific financial cost of the incident versus insurance coverage limits and deductibles.
- The timeline for full restoration of weekly and ancillary products representing 5% of revenue.
- Any subsequent regulatory notifications or fines issued by federal or state bodies.