Lee Enterprises, Incorporated
bd_43d738666169b421 · schema v1 · pii pii-v1
Full breach record for Lee Enterprises, Incorporated →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Qilin on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
All data will be published on March 5, 2025. We are preparing to share sensitive data with the public that could shed new light on Lee Enterprises, a prominent newspaper publishing firm active across all U.S. states. The documents we hold ab ...
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Feb 3, 2025
Claim posted
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- Illinois State AGbd_5237fce167e0e1102025-06-01 · +118dCandidate
- Nebraska State AGbd_0dbac1a45d4efc162025-06-03 · +120dVerified
- Montana State AGbd_19ef3d9a34d1e9e32025-06-03 · +120dVerified
- New Hampshire State AGbd_2ca38f39e16972c82025-06-03 · +120dVerified
Show 6 more filings ↓Show fewer ↑up to 122d gap
- Maine State AGbd_5c4976e1eeef53042025-06-03 · +120dVerified
- Vermont State AGbd_76c8276f9ce089732025-06-03 · +120dVerified
- Oregon State AGbd_31e8f14655399ee62025-06-04 · +121dVerified
- Massachusetts State AGbd_342bdbbebf2f7ed12025-06-04 · +121dVerified
- California State AGbd_7ab185d4c140c40d2025-06-04 · +121dVerified
- Texas State AGbd_ae0c7ca4d829002b2025-06-05 · +122dVerified
Showing first 10 of 13 linked disclosures.
Filing propagation · 11 filings · 10 states
View merged incident ↗Pattern: first filing Feb 3, last Jun 5 (TX) — a 122-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
qilin
According to ransomware.live, Qilin ransomware was first observed in July of 2022. Qilin Ransomware is written in Golang and supports multiple encryption modes; all of which are controlled by the operator. Qilin actors practice double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data.