Lee Enterprises Data Breach: Qilin Ransomware Attack Impacts 39,000 Individuals

Lee Enterprises, a major US media conglomerate, has confirmed a February 2025 ransomware attack compromised personal data of 39,000 individuals. The Qilin ransomware group, linked to North Korean threat actors, executed the attack using VMware ESXi encryptors and Rust-based malware, disrupting operations across 72 newspapers and 350+ publications for three weeks¹.

Attack Timeline and Technical Details

The breach began on February 10, 2025, when attackers gained access to Lee Enterprises’ network through unpatched VMware ESXi systems. Security researchers identified the intrusion when billing systems failed and digital newspaper access became intermittent. Qilin operators deployed custom ESXi encryptors targeting virtual machines, while parallel Rust-based malware exfiltrated 350GB of data including financial records and passport scans².

National CIO Review reported the attack caused a 5% revenue loss due to disrupted billing systems, forcing temporary shutdowns of print editions. Lee Enterprises’ SEC filing confirmed the material financial impact, though cybersecurity insurance covered response costs³. The ransomware group leaked samples of stolen data on March 1, 2025, including employee HR records and subscriber payment details.

Qilin Ransomware Tactics

Analysis by CPO Magazine revealed Qilin’s attack chain:

Initial access via phishing emails with malicious Office documents
Lateral movement using compromised domain admin credentials
Data exfiltration through encrypted TLS tunnels to bulletproof hosting providers
Deployment of Rust-based payloads with process hollowing techniques

Security Affairs researchers linked Qilin to Moonstone APT, a North Korean subgroup that previously targeted financial institutions⁴. The group’s VMware ESXi encryptor shares code similarities with earlier attacks against London hospitals in 2024 that affected 900,000 patients⁵.

Media Sector Vulnerabilities

This attack continues a pattern of ransomware targeting news organizations. In 2021, Norway’s Amedia suffered an attack that halted 78 newspapers, while The Guardian experienced a 2022 breach exposing staff data. Media companies present attractive targets due to time-sensitive operations and public trust implications⁶.

Lee Enterprises’ infrastructure audit revealed several security gaps:

Vulnerability	Impact
Unpatched VMware ESXi (CVE-2024-37085)	Allowed initial compromise
Lack of network segmentation	Enabled lateral movement
Cleartext credential storage	Facilitated privilege escalation

Mitigation Recommendations

For organizations with similar infrastructure:

Patch VMware ESXi systems immediately, prioritizing CVE-2024-37085
Implement network segmentation between editorial and billing systems
Deploy Rust-specific malware detection rules focusing on process injection patterns
Monitor for Qilin’s known C2 domains (updated weekly in Threat Intelligence reports)

Security Affairs recommends media companies conduct tabletop exercises simulating ransomware attacks on deadline-driven operations. The incident highlights the need for offline backup procedures that can sustain multi-week outages⁷.

Broader Implications

The Lee Enterprises attack demonstrates North Korean groups’ evolving ransomware tactics. Unlike previous financially-motivated attacks, this operation combined data theft with disruptive encryption, suggesting dual objectives of revenue generation and potential information operations against media outlets.

Recent CISA advisories have added several VMware vulnerabilities to the Known Exploited Vulnerabilities catalog, mandating federal agencies to patch them within strict deadlines⁸. Private sector organizations should treat these as equally critical.

As of June 2025, Qilin remains active with new attacks reported against European publishing houses. The group has updated its encryptor to bypass recent VMware patches, underscoring the need for defense-in-depth strategies beyond vendor updates.