Lee Enterprises paid out $2 million to restore operations following a ransomware attack.
In a recent turn of events, Lee Enterprises, a media company operating in 72 markets across 25 U.S. states, has been hit by a ransomware attack. The Qilin ransomware group, active in the cybercrime sphere, claimed responsibility for the attack, which encrypted critical applications and reportedly stole 350 gigabytes of data from the company.
The attack has had a significant impact on Lee Enterprises' finances. By freezing its ability to bill and collect money from customers and limiting its ability to pay vendors, the company incurred additional costs and faced a net loss of $12 million for the quarter. The attack also affected second-quarter advertising revenue for the company.
The long-term impacts on business resilience due to major cyber attacks, such as the one experienced by Lee Enterprises, can be extensive and multifaceted. One of the most immediate consequences is reputational damage and loss of customer trust. The breach compromised personal information of nearly 40,000 employees and subscribers, including highly sensitive data like Social Security numbers. Such breaches often erode consumer confidence and damage a company’s public image, making it harder to retain and attract customers in the long term.
Following the attack, regulatory scrutiny and legal consequences became a concern. Montana's Attorney General launched an investigation under consumer protection laws, demanding transparency about data collection and breach notification practices. This regulatory pressure can lead to fines, increased compliance costs, and stricter oversight, which affect operational flexibility and finances over time.
Beyond immediate incident response costs, companies must invest heavily in cybersecurity upgrades, legal defenses, and potential settlements. The ongoing need to bolster defenses and ensure compliance adds to long-term expenses, impacting profitability and business resilience.
Cyber attacks often disrupt business operations, requiring organizations to rethink and improve their incident response and disaster recovery plans. The experience pushes firms to adopt comprehensive cybersecurity strategies, including regular training, simulations, and cross-department coordination to enhance resilience against future attacks.
A major breach serves as a wake-up call, driving companies to integrate cybersecurity into the core of their business strategy. This includes ongoing investment not only in technology but also in people, processes, and preparedness to sustain operations and protect brand integrity amidst growing cyber threats.
Allie Mellen, a principal analyst, emphasized the importance of strong incident response processes to manage the fallout from incidents like the one at Lee Enterprises, particularly those affecting business continuity. Every minute counts in managing the fallout from ransomware incidents, according to Mellen, and ensuring personnel know what they need to do and when they need to do it can save precious time.
Lee Enterprises has not yet explained how the hackers gained access to its IT network. However, it is known that Qilin affiliates engaged in phishing attacks targeting an administrator at a managed service provider, Sophos reported. The company's sole lender, BH Finance, agreed to waive interest and basic rent payments in March, April, and May to help alleviate some of the financial burden.
The financial fallout from the attack underscores the potential long-term impacts on business resilience, with the average breach cost expected to be $2.7 million in 2024, according to Forrester. Tim Millage, VP, CFO and treasurer of Lee Enterprises, stated that while technical recovery is complete, there are lingering impacts on the company's balance sheet.
As the media industry continues to evolve, companies like Lee Enterprises must adapt to the growing cyber threats and invest in robust, proactive cybersecurity to build lasting business resilience.
[1] https://www.forbes.com/sites/forrester/2020/04/15/the-cost-of-a-data-breach-is-rising-and-so-are-the-risks/?sh=731418a1463e [2] https://www.forbes.com/sites/forrester/2021/05/27/the-cost-of-a-data-breach-is-rising-and-so-are-the-risks/?sh=46f6d9b736ba [3] https://www.forbes.com/sites/forbescom/2020/06/17/the-cost-of-a-data-breach-is-rising-and-so-are-the-risks/?sh=6b3d93e67427 [4] https://www.consumer.ftc.gov/articles/0003-data-breach [5] https://www.consumer.ftc.gov/articles/0497-consumer-reports-data-breach-database
- The attack on Lee Enterprises, a media company, by the Qilin ransomware group, has resulted in significant financial impacts, incurring additional costs and causing a net loss of $12 million for the quarter due to the encryption of critical applications and the theft of 350 gigabytes of data.
- The breach of Lee Enterprises' systems has compromised sensitive personal information of nearly 40,000 employees and subscribers, potentially damaging the company's reputation and consumer trust.
- Following the attack, the company faced regulatory scrutiny and legal consequences, such as an investigation by Montana's Attorney General under consumer protection laws, which can result in fines, increased compliance costs, and stricter oversight.
- To mitigate future risks and ensure business resilience, Lee Enterprises now faces ongoing expenses for cybersecurity upgrades, legal defenses, and potential settlements, along with the need for regular training, simulations, and cross-department coordination for incident response and disaster recovery plans.
