News-Press and Gazette Co. listed on termite ransomware leak site

• Ransomware group: termite
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: September 29, 2025

The News-Press and Gazette Co. has been listed on a leak site associated with the ransomware group known as termite. According to the announcement, the group claims to have successfully targeted the organization, resulting in a significant data breach.

The alleged attack and claims by termite

The termite group has claimed responsibility for a data breach involving News-Press and Gazette Co., with the announcement appearing on September 29, 2025. The group alleges that they have gained unauthorized access to the company's internal systems and have subsequently acquired a substantial amount of data. Specifically, the group claims to have exfiltrated approximately 230 GB of information from the organization.

The announcement suggests that the breach involves the compromise of the company's commercial and operational documents. While the group has posted the organization's name on their leak site, they have not provided information regarding a specific ransom demand. The incident was reported on the same day the group claimed the attack occurred, on September 29, 2025.

Data types and information involved

Based on the files visible in the screenshots provided by the threat actor, the breach appears to involve sensitive corporate and financial information. The exfiltrated data is alleged to include various types of documentation that could impact the company's privacy and operations. The specific items identified in the listing include:

• Bank statements
• Financial reports
• Payment records
• Corporate documents

The presence of these documents suggests that the attackers may have accessed sensitive financial and administrative files during their time within the network.

About News-Press and Gazette Co.

News-Press & Gazette Company is a media organization that publishes daily newspapers and weekly publications. In addition to its print media operations, the company operates television and radio stations. Its business model is diversified, as it also provides cable internet, digital telephone services, and commercial printing solutions.

Analysis and potential implications

This alleged breach may lead to the exposure of the company's financial data and operational processes. The publication of such data could increase the risk of identity theft or targeted phishing attacks for the company's employees and customers. Given that the company is based in the United States, the incident may trigger state-level data privacy laws and potential legal obligations for the organization.

Public information regarding the termite group remains limited. However, it is important to note that ransomware groups typically employ double-extortion tactics. This method involves both encrypting a victim's data and stealing it, using the threat of leaking the stolen information to exert pressure on the company's operational continuity. By threatening to release sensitive documents, attackers aim to force the victim into paying a ransom to prevent the public disclosure of their data.

In such scenarios, organizations often face significant challenges in managing both the technical recovery of their systems and the reputational management resulting from the potential leak of sensitive information. For companies operating in the media and telecommunications sectors, maintaining the integrity of client data and operational documents is critical to maintaining public trust and meeting regulatory requirements.