UnknownTelecom & MediaInformationEmployee Data InvolvedIdentity (basic)PIILowContained

Lee Enterprises, Incorporated

bd_7ab185d4c140c40d · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 3, 2025

Filed

Jun 4, 2025

To disclose

17 weeks

Affected

Not disclosed

Linked

14 filings

Confidence

64%

Full breach record for Lee Enterprises, Incorporated →

Lee Enterprises notified the California AG of a data security incident affecting employee personal information. Unauthorized access occurred on February 1, 2025, and was first detected on February 3, 2025. The company engaged cybersecurity specialists, notified the FBI, and is offering identity theft protection services to affected individuals. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 3, 2025 → Notified Jun 3, 2025120d ✗ CA 60-day late17 weeks discovery → filing

Incident timeline

undetected · 2 days

discovery → filing · 17 weeks / 121 days

Feb 1, 2025

Begins

Feb 3, 2025

Discovered

Jun 4, 2025

Filed

This filing is one of 14 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Oregon State AGbd_31e8f14655399ee62025-06-04Verified
Massachusetts State AGbd_342bdbbebf2f7ed12025-06-04Verified
Texas State AGbd_ae0c7ca4d829002b2025-06-05 · +1dVerified
Nebraska State AGbd_0dbac1a45d4efc162025-06-03 · +1dVerified

Show 6 more filings ↓up to 90d gap

Montana State AGbd_19ef3d9a34d1e9e32025-06-03 · +1dVerified
New Hampshire State AGbd_2ca38f39e16972c82025-06-03 · +1dVerified
Maine State AGbd_5c4976e1eeef53042025-06-03 · +1dVerified
Vermont State AGbd_76c8276f9ce089732025-06-03 · +1dVerified
Illinois State AGbd_5237fce167e0e1102025-06-01 · +3dCandidate
SEC 8-Kbd_a2d5ab16cd5f49522025-03-06 · +90dVerified by operator

Showing first 10 of 13 linked disclosures.

Name: Lee Enterprises, Incorporated
norm: lee
Domain: lee.net

Name: Lee Enterprises, Incorporated
norm: lee
Domain: lee.net
Industry: Telecom & Mediallm

Discovered: Feb 3, 2025
Breach occurred: Feb 1, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 3, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)PII
Attack vector: Unknown
Regulator citations: Notified the Federal Bureau of Investigation

During the incident: Initiated an investigation of the matter
Engaged cybersecurity specialists to assist with the incident response
Undertook a comprehensive review with the help of a third-party vendor
Notified the Federal Bureau of Investigation
Offering identity theft protection services through IDX
Changes made: Implemented measures to enhance security and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(121 days from discovery to filing)
Compliance flags: CA 60-day late · 120dLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 3, 2025
→ Notified: Jun 3, 2025
120d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 3, 2025 → Notified: Jun 3, 2025	120d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

SEC 8-KMar 6 · first

Illinois State AG+87d

Nebraska State AG+89d

Montana State AG+89d

New Hampshire State AG+89d

Maine State AG+89d

Vermont State AG+89d

Oregon State AG+90d

Massachusetts State AG+90d

California State AG+90d · this page

Texas State AG+91d

Pattern: first filing Mar 6, last Jun 5 (TX) — a 91-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 13 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-603619
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 4, 2025
Raw hash: 138850a4d0fc469168790a87f0bc6bea21ef4dfefe82fc3c103ebb0660901d11

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityLee Enterprises, Incorporated

Victim entityLee Enterprises, Incorporated

Incidentdiscovered Feb 3, 2025

Stated responseInitiated an investigation of the matter

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov