Lee Enterprises Agrees $9.5M Payout After Nationwide Data Breach

Lee Enterprises, an Iowa-based newspaper company owning hundreds of publications across 25 states, including prominent Iowa and Montana newspapers, has agreed to pay $9.5 million to subscribers in a privacy violation settlement following a February 2025 data breach. The breach compromised personal information of both subscribers and employees, temporarily disrupting some newspaper publications. Subsequently, Lee now faces three class-action invasion-of-privacy lawsuits filed in the U.S. District Court for the Southern District of Iowa by current and former employees alleging negligence, breach of implied contract, unjust enrichment, and insufficient disclosure about the breach details. Plaintiffs argue that Lee's notification letters failed to provide essential information regarding the breach's cause, exploited vulnerabilities, and remedial actions, limiting employees' ability to mitigate potential harm. The lawsuits claim Lee could have prevented the breach by better securing and encrypting sensitive data and enhancing cybersecurity training and monitoring systems. Named plaintiffs represent thousands of employees across multiple states, underscoring the widespread impact of the incident.