LEE ENTERPRISES, Inc

Cybersecurity Incident

On February 3, 2025, the Company experienced a systems outage caused by a cybersecurity attack by threat actors who unlawfully accessed the Company's network, encrypted critical applications, and exfiltrated certain files (the "Cyber Incident"). Upon discovery, the Company promptly activated its incident response plan, engaging both internal teams and third-party cybersecurity experts.

Following the containment of the initial threat and as a result of a subsequent, comprehensive review with a third-party vendor, the Company determined certain files may have been accessed or acquired on February 1, 2025, including customers' and subscribers personal information. The Company reported the Incident to relevant law enforcement and will cooperate with any resulting investigation or efforts to hold the perpetrators accountable. In addition, through a data breach and recovery services vendor, the Company is offering identity theft protection services to those customers and subscribers potentially involved in the data breach.

During the three months ended June 29, 2025, the Company incurred $1.2 million of expenses related to the Cyber Incident. During the nine months ended June 29, 2025, the Company incurred $3.1 million of expenses related to the Cyber Incident. These expenses are recognized in "Restructuring and Other" in the Consolidated Statements of Loss and Comprehensive Loss. The Cyber Incident remains under legal and forensic investigation, including evaluation of the extent and potential risk related to unauthorized access to sensitive data.

The incident continues to have a significant negative impact on the Company's 2025 operating results. Various revenue lines were impacted, certain operating expenses are trending higher than they were prior to the incident, and many projects underway were significantly delayed. While operating impacts from the incident have not been fully realized, the Company estimates the incident impacted revenue by more than $10 million.

The Company maintains cyber insurance coverage to limit its exposure to losses such as those related to the Cyber Incident, subject to a $500,000 deductible. Coverage includes, among other things, the cost of recovery and restoration as well as business interruption. The Company has submitted claims to its insurers for reimbursement of certain costs, expenses, and losses stemming from the Cyber Incident. To date, $707,000 reimbursements have been received, however the claims processing is ongoing as of the date of this filing.

Rights Agreement

On March 28, 2024, our Board of Directors adopted a stockholder rights plan (the “Rights Agreement”). Pursuant to the Rights Agreement, on March 28, 2024, our Board of Directors declared a dividend of one preferred share purchase right (a “Right”), payable on April 8, 2024, for each share of our Common Stock outstanding to the stockholders of record on that date. Each Right entitles the registered holder to purchase from the Company one one-thousandth of a share of Series C Participating Convertible Preferred Stock, without par value (the “Preferred Shares”), of the Company at a price of $90.00 per one one-thousandth of a Preferred Share represented by a Right, subject to adjustment.

The Rights will initially trade with our Common Stock and will generally become exercisable only if any person or group, other than certain exempt persons, acquires beneficial ownership of 15% or more of our Common Stock outstanding. In the event the Rights become exercisable, each holder of a Right, other than the triggering person(s), will be entitled to purchase additional shares of our Common Stock at a 50% discount or the Company may exchange each Right held by such holders for one share of our Common Stock. The Rights Agreement was to continue in effect until March 27, 2025, or unless earlier redeemed or terminated by the Company, as provided in the Rights Agreement. On March 27, 2025, the Board of Directors extended the termination date of the Rights Agreement to March 27, 2026 The Rights have no voting or dividend privileges, and, unless and until they become exercisable, have no dilutive effect on the earnings of the Company.

The Rights Agreement applies equally to all current and future stockholders and is not intended to deter offers or preclude our Board of Directors from considering acquisition proposals that are fair and otherwise in the best interest of our stockholders. However, the overall effect of the Rights Agreement may render it more difficult or discourage a merger, tender offer, or other business combination involving us that is not supported by our Board of Directors.