Hacker attack on major American media company exposes employees

Tens of thousands of employees at Lee Enterprises have had their personal details accessed by hackers, including Social Security numbers.

Attackers accessed the media company’s systems in early February of this year, Lee Enterprises explained to impacted individuals in its breach notification letter. Even though the company managed to secure its networks the same day, cybercriminals had time to access databases with sensitive employee data.

Lee Enterprises publishes over 70 newspapers covering half of the US states and over 200 million of its online pages are viewed every month.

After the company discovered malicious actors penetrating its systems, it launched an investigation into the incident. After three months of going through details of the attack, third-party cybersecurity pros hired by the company deduced that attackers may have accessed some personal staff details.

The exposed personal information includes first and last names as well as Social Security numbers (SSNs). Attackers could utilize exposed SSNs for nefarious purposes, such as identity theft, phishing and fraud.

For example, attackers could attempt to impersonate the company’s staff to access more sensitive systems with information hackers would deem even more valuable.

According to information Lee Enterprises submitted to the Maine Attorney General’s Office, nearly 40,000 individuals were exposed in the attack. Since the company employs around 4,500 people at the moment, this strongly points to past employees being impacted as well.

Headquartered in Davenport, Iowa, Lee Enterprises run newspapers in 26 US states. The company reported revenue exceeding $611 million in 2024.