Campus Alert Archive
Lincoln

The Ransomware Attack That Killed a 157-Year-Old College

ILinfrastructure failureadvisorymedium confidence
Confirmed Threat

Lincoln College, a small predominantly Black-serving institution in central Illinois, was struck by a ransomware attack in December 2021 that paralyzed admissions and student records for months. Combined with COVID-era enrollment losses, the recovery effort proved fatal: on May 13, 2022, the college closed permanently after 157 years, becoming the first U.S. college closure directly attributed to a ransomware attack.

Alerts
2
Response
min
Killed
0
Injured
0
Institution
Lincoln College
Private Bachelors · IL
~700 studentsLincoln College Alerts
Confirmed Timeline

Alert Sequence

2 messages in sequence · 1 verified verbatim

Some alert texts below are approximate reconstructions from news coverage, not confirmed verbatim transcripts. Reconstructed texts are shown in italic with a dashed border. Verified verbatim texts have a solid border and are marked accordingly.

INITIAL ALERTEmail
Approximate reconstructionBleepingComputer — paraphrasing Lincoln College's December 2021 community notification466 chars
Lincoln College has experienced a cybersecurity incident affecting institutional systems. Our IT team has taken systems offline as a precaution. Email, the student information system, and admissions portals are currently inaccessible. We are working with cybersecurity professionals to investigate and restore service. Faculty and staff should not attempt to log in to college systems until further notice. Please continue to monitor your personal email for updates.

This text has been reconstructed from news coverage and may not reflect the exact original wording.

Reconstructed from press accounts; Lincoln College's emergency archive went offline along with the rest of its infrastructure when the college closed in May 2022.
Note the absence of specifics — early ransomware notifications typically avoid the word 'ransomware' until the FBI and insurers approve language.
FOLLOW-UPEmail
Verified verbatimCBS News — quoting the Lincoln College closure statement attributed to President David Gerlach813 chars
Lincoln College has survived multiple economic depressions, the 1918 Spanish flu, both World Wars, the Great Depression, the Great Recession, and more, but this is different. The COVID-19 pandemic and a ransomware cyberattack in December 2021 thwarted admissions activities and hindered access to all institutional data, creating an unclear picture of Fall 2022 enrollment projections. All systems required for recruitment, retention and fundraising efforts were inoperable. Fortunately, no personal identifying information was exposed. Once fully restored in March 2022, the projections displayed significant enrollment shortfalls, requiring a transformational donation or partnership to sustain Lincoln College beyond the current semester. Lincoln College will close its doors at the end of the spring semester.
The phrase 'this is different' was the line that broke through nationally — it framed the closure as a uniquely modern catastrophe.
Verbatim from the public statement issued by President David Gerlach on May 9, 2022, archived in CBS News and NPR coverage.
Context

Background

Lincoln College, founded in 1865 and named for President Abraham Lincoln during his lifetime, was a small private institution in central Illinois with a predominantly Black student population of about 700 students. In December 2021, an Iran-based ransomware actor encrypted the institution's admissions, recruitment, retention, and fundraising systems. The college paid less than $100,000 in ransom and regained access in March 2022, but by then the damage was done: with no visibility into projected fall enrollment, the institution could not recruit, retain donors, or plan operations. President David Gerlach announced on May 9, 2022, that the college would close permanently on May 13, making Lincoln the first U.S. higher-education institution whose closure was directly attributed to a ransomware attack. The case became a touchstone in cybersecurity policy debates about the existential risk poorly-funded institutions face from sophisticated nation-state-aligned threat actors.
Analysis

Key Findings

Ransomware attack in December 2021 traced to Iran-based actor.
Less than $100,000 paid in ransom; systems restored in March 2022.
Closure announced May 9, 2022; college closed permanently May 13, 2022.
First U.S. college closure directly attributed to a ransomware attack.
Outcome
College paid less than $100,000 in ransom and regained access to its systems in March 2022. The institution permanently closed on May 13, 2022. The attack was traced to Iran.
Provenance

Sources

  1. News
    Ransomware attack shutters 157-year-old Lincoln College — CBS News
    cbsnews.com
  2. News
    Lincoln College closes after 157 years — NPR
    npr.org
  3. News
    Lincoln College to close after ransomware attack — BleepingComputer
    bleepingcomputer.com
  4. News
    Ransomware attack, COVID combine to shutter Illinois college — NBC News
    nbcnews.com
  5. News
    Lincoln College Closure Is Just Another Ransomware Milestone — Governing
    governing.com
Tags
ransomwarecyber-attackinfrastructure-failurepermanent-closureillinois20212022
Added May 2026Updated May 2026Via ingestion