Lee Enterprises (LEE) Risk Analysis

Natural disasters and extreme weather conditions, such as hurricanes, derecho windstorms, floods, earthquakes, wildfires; acts of terrorism or violence, including active-shooter situations; and public health issues, including pandemics and quarantines, could negatively affect our operations and financial performance. Such events could result in physical damage to our properties, disruptions to our IT systems, temporary or long-term disruption in the supply of products from our suppliers, and delays in the delivery of goods to our printing facilities. Public health issues, whether occurring in the U.S. or Canada, could disrupt our operations, the operations of suppliers, or have an adverse impact on consumer spending and confidence levels.

We rely on our information technology and communications systems to manage our business data, including communications, news and advertising content, digital products, order entry, fulfillment and other business processes. These technologies and systems also help us manage many of our internal controls over financial reporting, disclosure controls and procedures and financial systems. Attempts to compromise information technology and communications systems occur regularly across many industries and sectors, and we may be vulnerable to security breaches resulting from accidental events (such as human error) or deliberate attacks. Moreover, the techniques used to attempt attacks and the perpetrators of such attacks are constantly expanding. We face threats both from use of malicious code (such as malware, viruses, and ransomware), employee theft or misuse, advanced persistent threats, and phishing and denial-of-service attacks. The Company has complied with all applicable legal requirements relating to this activity. As cyberattacks become increasingly sophisticated, and as tools and resources become more readily available to malicious third parties, the Company will incur increased costs to secure its technology environment and there can be no guarantee that the Company's and our third-party vendors' actions, security measures and controls designed to prevent, detect or respond to security breaches, to limit access to data, to prevent destruction, alteration, or exfiltration of data, or to limit the negative impact from such attacks, can provide absolute security against compromise. As a result, our business data, communications, news and advertising content, digital products, order entry, fulfillment and other business processes may be lost, destroyed, disclosed, misappropriated, altered or accessed without consent and various controls, automated procedures and financial systems could be compromised. A significant security breach or other successful attack could result in significant remediation costs, including repairing system damage, engaging third-party experts, deploying additional personnel or vendor support, training employees, and compensation or incentives offered to third parties whose data has been compromised. These incidents may also lead to lost revenues resulting from a loss in competitive advantage due to the unauthorized disclosure, alteration, destruction or use of business data, the failure to retain or attract customers, the disruption of critical business processes or systems, and the diversion of management's attention and resources. Moreover, such incidents may result in adverse media coverage, which may harm our reputation. These incidents may also lead to legal claims or proceedings, including regulatory investigations and actions and private lawsuits, and related legal fees, as well as potential settlements, judgments and fines. We maintain insurance, but the coverage and limits of our insurance policies may not be adequate to reimburse us for losses caused by security breaches.

The safe and responsible integration of AI functionality as it rapidly evolves presents emerging ethical and legal challenges, and the use of such technologies may result in diminished brand trust and reputational harm. Our competitors are integrating AI into their business practices which may result in competitive harm and the need to allocate significant resources to protect intellectual property. To responsibly remain competitive, we must develop and maintain our digital platform and ethically integrate new AI functionality in accordance with evolving compliance requirements. Developments in the AI field will simultaneously increase both competition and liability risks while also altering the market for our services. In addition, the use of AI by bad actors presents increasingly complex and sophisticated security threats to our confidential subscriber, employee, and Company data, and we must make additional efforts to maintain network security.

We compete for audiences and advertising revenue with newspapers and other media such as web-based digital platforms (e.g., Alphabet, Amazon, Meta, TikTok etc.), magazines, broadcast, cable and satellite television, radio, direct mail, and billboards. As the use of the internet and mobile devices has increased, we have lost some classified advertising and subscribers to online advertising businesses and free Internet sites that contain abbreviated versions of our publications. Some of our current and potential competitors have greater financial and other resources than we have. If we fail to compete effectively with competing newspapers and other media, our results of operations may be materially adversely affected.

A significant portion of our revenue is derived from advertising and a decline in the financial or economic conditions of our advertisers could alter discretionary spending by those advertisers. Our publications' and websites' advertisers are primarily retail businesses, which have been challenged in recent years by increased competition from online retailers. This trend has reduced and may continue to reduce advertising revenue from the brick-and-mortar retail sector. Specifically, advertising revenues may worsen if advertisers reduce their budgets, shift their spending priorities, are forced to consolidate, or cease operations.

Our online systems store and process confidential subscriber and other sensitive data, such as names, email addresses, addresses, and other personal information. Therefore, maintaining our network security is critical. Additionally, we depend on the security of our third-party service providers. Unauthorized use of or inappropriate access to our, or our third-party service providers' networks, computer systems and services could potentially jeopardize the security of confidential information, including payment card (credit or debit) information, of our customers. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and often are not recognized until launched against a target, we or our third-party service providers may be unable to anticipate these techniques or to implement adequate preventative measures. A party that is able to circumvent our security measures could misappropriate our proprietary information or the information of our customers or users, cause interruption in our operations, or damage our computers or those of our customers or users. As a result of any such breaches, customers or users may assert claims of liability against us and these activities may subject us to legal claims, adversely impact our reputation, and interfere with our ability to provide our products and services, all of which may have an adverse effect on our business, financial condition and results of operations. The coverage and limits of our insurance policies may not be adequate to reimburse us for losses caused by security breaches. A significant number of our customers authorize us to bill their payment card accounts directly for all amounts charged by us. These customers provide payment card information and other personally identifiable information which, depending on the particular payment plan, may be maintained to facilitate future payment card transactions. Under payment card rules and our contracts with our card processors, if there is a breach of payment card information that we store, we could be liable to the banks that issue the payment cards for their related expenses and penalties. In addition, if we fail to follow payment card industry data security standards, even if there is no compromise of customer information, we could incur significant fines or lose our ability to give our customers the option of using payment cards. If we were unable to accept payment cards, our business would be seriously harmed. There can be no assurance that any security measures we, or our third-party service providers, take will be effective in preventing a data breach. We may need to expend significant resources to protect against security breaches or to address problems caused by breaches. If an actual or perceived breach of our security occurs, the perception of the effectiveness of our security measures could be harmed and we could lose customers or users. Failure to protect confidential customer data or to provide customers with adequate notice of our privacy policies could also subject us to liabilities imposed by United States federal and state regulatory agencies or courts. We could also be subject to evolving state laws that impose data breach notification requirements, specific data security obligations, or other consumer privacy-related requirements. Our failure to comply with any of these laws or regulations may have an adverse effect on our business, financial condition and results of operations.