8-K/A: Lee Enterprises Faces Material Financial Impact from Cyberattack, Waives Interest Payments

Lee Enterprises reports a material cybersecurity incident that caused a system outage, impacting business processes and financial condition, leading to a waiver of interest and lease payments.

Summary

• Lee Enterprises experienced a cybersecurity attack on February 3, 2025, leading to a system outage.
• The attack involved unauthorized access, encryption of critical applications, and exfiltration of files.
• The company has contained the threat and is working to restore business processes.
• Product production and distribution continue, but with limitations.
• Back-office functions like billing, collections, and vendor payments are delayed.
• The company anticipates full restoration of business processes in the coming weeks.
• An investigation is ongoing to determine if personally identifiable information was compromised, with results expected in the next several weeks.
• The incident is likely to have a material impact on the company's financial condition and results of operations.
• Lee Enterprises has cyber insurance coverage and expects costs beyond a small retainer to be reimbursed.
• To address short-term liquidity, the company has agreed with its lender to waive interest payments due in March 2025.
• A waiver also applies to lease payments in March 2025, providing $3.7 million of additional capital.
• Waived interest and rent payments will be added to the principal amount due under the Credit Agreement.
• The company's lender is BH Finance LLC, and the lease agreement is with BH Media Group, Inc.

Sentiment

Score: 3

Explanation: The sentiment is negative due to the cybersecurity attack, the expected material financial impact, and the delays in business processes. However, the presence of cyber insurance and the waiver of interest payments provide some mitigation.

Positives

• The cybersecurity threat has been contained.
• The company is working to restore automation of its business processes.
• All products are being produced and distributed, albeit with some limitations.
• Lee Enterprises has comprehensive cyber insurance coverage.
• The waiver of interest and lease payments will provide $3.7 million of additional capital.

Negatives

• The cybersecurity incident caused a system outage and impacted business processes.
• Certain back-office functions remain delayed, including billing, collections, and payments to vendors.
• The full scope of the financial impact is not yet known, but it is likely to be material.
• There are limitations in the depth of products due to tightened schedules.

Risks

• The full scope of the financial impact of the cybersecurity incident is not yet known.
• There is a risk that personally identifiable information was taken by the threat actors.
• The company's actual results could differ materially from forward-looking statements due to various factors, including additional findings regarding the impact of the Incident and the company's remedial actions.

Future Outlook

The company anticipates business processes to be fully restored in the coming weeks and expects a definitive answer regarding the potential compromise of personally identifiable information in the next several weeks. The company expects costs in excess of a small retainer to be reimbursed by insurance.

Industry Context

Cybersecurity incidents are a growing concern across all industries, and media companies are not immune. This incident highlights the importance of robust cybersecurity measures and incident response plans. Other media companies have faced similar attacks, leading to increased investment in cybersecurity and data protection.

Comparison to Industry Standards

• Many companies of similar size to Lee Enterprises maintain cyber insurance policies to mitigate financial risks associated with data breaches and cyberattacks.
• Waiving interest payments to maintain liquidity during a crisis is a strategy sometimes employed by companies facing financial distress, similar to actions taken by other companies in the media industry during economic downturns.
• The incident response and remediation efforts described are consistent with industry best practices for handling cybersecurity incidents, including engaging third-party security vendors and conducting forensic analysis.

Related Party Transactions

• The Covenant Waiver applies to lease payments in March 2025 owed to BH Media Group, Inc., a Delaware corporation, under the Lease Agreement dated March 16, 2020, between the Company and BH Media.

Stakeholder Impact

• Shareholders may be concerned about the potential financial impact of the cybersecurity incident.
• Employees may experience disruptions in their work due to the system outage and delays in business processes.
• Customers may experience delays in billing and other services.
• Vendors may experience delays in payments.

Next Steps

• Continue working with third-party security vendors to restore automation of business processes.
• Complete the investigation and forensic analysis to determine whether personally identifiable information was taken.
• Seek reimbursement from insurance for costs associated with the cybersecurity incident.

Key Dates

Keywords

cybersecurity incident, system outage, financial impact, insurance coverage, interest waiver, lease payments, data breach, remediation, liquidity, Lee Enterprises