Montana Attorney General Launches Investigation Into Lee Enterprises Data Breach

HELENA, Mont. — Montana Attorney General Austin Knudsen launched an investigation Wednesday into Lee Enterprises following a cyberattack that compromised the personal information of nearly 40,000 subscribers and employees.

The investigation, conducted under Montana’s Consumer Protection Act, targets the multistate media company that owns five major newspapers across the state, including the Billings Gazette, Helena Independent Record, Missoulian, Montana Standard and Ravalli Republic.

According to the attorney general’s office, the stolen data includes first and last names as well as Social Security numbers. Lee Enterprises has one month to respond to the Civil Investigative Demand.

“Identity theft associated with data breaches threaten Montanans’ financial security,” Knudsen said in a statement. “It is my job as Attorney General to protect Montanans by ensuring companies that collect and store our personal and financial information do so responsibly and comply with all applicable laws.”

The investigation follows a March ransomware attack by the Qilin group that disrupted operations across Lee Enterprises publications nationwide. The hackers allegedly compromised 350 GB of sensitive data and threatened to release the information if their demands were not met.

At the time, Helena Independent Record employees were advised to freeze their personal credit following the breach. The company has not issued a comprehensive public statement addressing the potential exposure of customer information.

Knudsen is demanding Lee Enterprises identify what type of customer information they collect and how it’s used, as well as details about when and how they notified affected customers about the breach.

The attorney general’s office said the Consumer Protection Act exists specifically to safeguard Montanans’ online personal and financial information.

Lee Enterprises operates newspapers in 26 states and has faced financial challenges in recent years, including bankruptcy proceedings and debt restructuring.