Lee Enterprises Faces $9.5 Million Payout and Lawsuits Over Data Breach

Strategic Insights -

A data breach at the Iowa-based newspaper company Lee Enterprises has led to a proposed settlement of $9.5 million with subscribers who allege privacy violations, as well as three new lawsuits from current or former employees. The lawsuits, filed in U.S. District Court for the Southern District of Iowa, claim that Lee is guilty of negligence, breach of an implied contract, unjust enrichment, and invasion of privacy. The plaintiffs, Nicole Church, Declan Lawson, and Anthony Bangert, are seeking class-action status on behalf of thousands of current and former Lee employees whose personal information is believed to have been accessed by cybercriminals.

Key Takeaways:

  • Lee Enterprises has agreed to pay $9.5 million to settle a lawsuit with subscribers alleging privacy violations.
  • The three new lawsuits, filed by current or former employees, claim that Lee is guilty of negligence, breach of an implied contract, unjust enrichment, and invasion of privacy.
  • The plaintiffs, Nicole Church, Declan Lawson, and Anthony Bangert, are seeking class-action status on behalf of thousands of current and former Lee employees.
  • Lee's Iowa newspapers, including the Quad-City Times, Sioux City Journal, and Mason City Globe-Gazette, were affected by the data breach.
  • The breach occurred on June 3, 2025, and Lee began sending letters to affected employees advising them of the incident, but failed to provide critical facts surrounding the breach.
  • The lawsuits claim that Lee could have prevented the data breach by properly securing and encrypting employee data, and by training employees on standard cybersecurity practices.
  • Lee has incurred $2 million in expenses related to restoring data systems and has indicated that the breach affected the company's finances by hampering its ability to bill customers and pay vendors.
  • The data breach involved 39,779 individuals and included personally identifiable information and confidential files.
  • Two Iranian nationals were charged in 2020 for allegedly hacking into Lee's systems as part of a disinformation campaign related to the 2020 presidential election.
  • A group of subscribers to Lee newspapers sued the company in December 2022 for online privacy violations and reached a proposed settlement in March 2025.

Statistics:

  • $9.5 million: proposed settlement with subscribers alleging privacy violations
  • 3: number of lawsuits filed by current or former employees
  • 24: number of states where Lee Enterprises publishes hundreds of newspapers and specialty publications
  • 350 gigabytes: amount of data allegedly stolen from Lee by the Qilin ransomware group
  • 39,779: number of individuals whose personally identifiable information was affected by the data breach
  • $2 million: expenses incurred by Lee related to restoring data systems
  • 1,528,941: number of paid subscribers to Lee newspapers who accessed video material on a Lee website and used Facebook between December 2020 and March 4, 2025

Sources:

  • [Source 1: "Lee Enterprises Agrees to $9.5 Million Payout in Subscriber Case" by the Iowa Capital Dispatch]
  • [Source 2: "Three Lawsuits Claim Lee Enterprises Failed to Protect Employee Data" by the Iowa Capital Dispatch]
  • [Source 3: "Lee Enterprises Hack Allegedly Involved Iranian Nationals" by the Wall Street Journal]
  • [Source 4: "Subscriber Lawsuit Accuses Iowa Newspaper Publisher of Online Privacy Violations" by the Iowa Capital Dispatch]