Lincoln College — The First American College Killed in Part by Ransomware
Summary
Lincoln College, a small private college in the rural central-Illinois town of Lincoln, was founded in 1865 — its cornerstone laid on Abraham Lincoln's birthday that February, while the president for whom it was named was still alive — and it closed for good on May 13, 2022, after 157 years. By the end it had become a predominantly Black institution recognized as such by the U.S. Department of Education, serving a heavily first-generation, lower-income student body. It died of two compounding wounds: the enrollment and revenue damage of the COVID-19 pandemic, and a December 2021 ransomware attack that crippled the very systems it needed to recruit its way out of the hole. Lincoln became the first U.S. college whose closure was attributed, in part, to a cyberattack.
The financial pressure was already severe. Like most tuition-dependent small colleges, Lincoln depended on each incoming class to fund the year, and the pandemic hammered both recruitment and the auxiliary revenue — housing, dining, events — that a residential college relies on. Enrollment had crested near 1,330 in the mid-2000s; by the pandemic the college was working to keep numbers from sliding further. It was wounded but not yet fatally so. Then, on December 19, 2021, came the ransomware.
The attack, which the college traced to Iran, locked Lincoln out of the systems that ran admissions, recruitment, retention, and fundraising for more than a month. The timing could hardly have been worse: this was precisely the window in which a college recruits and confirms its next fall class. Lincoln paid a ransom — under $100,000 — and regained access in March 2022, but by then it had lost the recruiting cycle and could not see its own enrollment pipeline. When the data came back online, the picture was grim: projections for fall 2022 fell "woefully short" of what the college needed to survive, and leadership estimated it would take as much as $50 million, or a transformational partnership, to keep the doors open.
There was no $50 million and no rescuer. President David Gerlach told staff the institution would close on May 13, 2022, and a GoFundMe appeal raised only a few thousand dollars against a far larger need. The closure stranded a student body that small colleges like Lincoln exist precisely to serve — first-generation students, many of them Black, in a part of Illinois with few alternatives nearby — and emptied a campus that had stood since the Civil War. A college named for the president who saved the Union outlasted him by 157 years and was finished, in the end, by a virus and a hacker.
Timeline
A College Named for a President
There is something almost unbearably American about Lincoln College's origin. Its founders laid the cornerstone in February 1865, on Abraham Lincoln's birthday, while the man was still alive and the Civil War still grinding toward its end — making it, by its own account, the only college named for Lincoln during his lifetime. It rose in a small central-Illinois town that also took his name, and for 157 years it did the unglamorous work of educating the students who lived nearby: a junior college, then a four-year college, never large, never rich, but woven into the life of its town and region.
By its final decades, Lincoln had become something its founders could not have imagined and that the country needs more of: a residential college serving a heavily first-generation, lower-income student body, recognized by the U.S. Department of Education as a predominantly Black institution. These are the students for whom a small college is not a brand choice but a door — the first in their families to attend, often with few other options within reach. A college like that closing is not the loss of a luxury good. It is the closing of one of the few doors a particular set of students had.
Wounded by the Pandemic
The vulnerability underneath was the familiar one. Lincoln was tuition-dependent, with no great endowment to absorb a shock, and as a residential college it leaned on auxiliary revenue — the dorms, the dining halls, the campus life — that only exists when students are physically present. COVID-19 attacked both flanks at once. It depressed enrollment and recruitment as families deferred or balked, and it gutted the auxiliary income when campuses emptied. Enrollment, which had crested near 1,330 in the mid-2000s, was something the college now had to fight to hold steady; staying flat, in a pandemic, was itself a struggle.
This is the condition in which a great many small colleges entered 2021: wounded, thin on reserves, but still standing, still recruiting, still betting that a strong incoming class could stabilize the books. Recruitment was the lifeline. A tuition-dependent college that can still bring in its next class can buy itself another year, and another, and perhaps find its footing. Everything depended on the machinery that finds, courts, and enrolls students — the admissions and recruitment systems that, for a modern college, live entirely on its computers. That machinery was exactly what the attackers took.
The Attack That Finished It
On December 19, 2021, ransomware locked Lincoln College out of the systems it ran admissions, recruitment, retention, and fundraising on, and the lockout lasted more than a month. The college traced the attack to Iran. The cruelty of the timing was specific: December through early spring is when a college recruits and confirms its fall class, and Lincoln spent that window blind — unable to see its applicant pipeline, unable to process recruitment, unable to fundraise through the systems that held its donor data. It paid a ransom of under $100,000 and recovered access in March 2022. By then the damage was done. The recruiting cycle had passed, and when the restored data finally rendered a picture of fall 2022, the enrollment projections were, in the college's word, "woefully short" of survival.
The arithmetic that followed was brutal and quick. Leadership concluded Lincoln would need as much as $50 million, or a transformational donation or partnership, to continue beyond the spring. There was no donor, no partner, no fund of that size. A public GoFundMe appeal, with a goal in the millions, drew only a few thousand dollars — a measure of how far a heartfelt plea falls short of a structural deficit. On March 30, 2022, President David Gerlach informed employees that the college would close permanently on May 13. He called it heartbreaking, and it was: the pandemic had wounded Lincoln, but the ransomware had blinded it during the one season it most needed to see, and a college that cannot recruit cannot live. Lincoln earned a grim distinction in the process — the first American college whose death was credited, in part, to a cyberattack.
The Five Factors
Aftermath
Lincoln's closure fell hardest on the students it had been built, by its final form, to serve: first-generation, lower-income, disproportionately Black students in a rural stretch of Illinois with few nearby alternatives. The college worked to help them transfer, but a transfer is not a teach-out, and for students who chose Lincoln precisely because it was close, affordable, and welcoming, the nearest substitute was rarely any of those things. Staff and faculty in a small town lost their jobs in a place where the college was a significant employer, and a campus that had stood since 1865 emptied within weeks of the announcement.
Beyond its own town, Lincoln became a case study cited well outside higher education — in the world of cybersecurity, where its closure is invoked as the moment ransomware crossed from operational nuisance to existential threat for an underfunded institution. The lesson security professionals drew is the one the college's death makes plain: an attack that paralyzes a fragile organization during its most critical operating window can finish it, even when the ransom itself is modest. Lincoln paid under $100,000 to the attackers and could not pay the far larger price the lost recruiting season exacted. A college named for the president who held the Union together survived him by 157 years and was undone by a pandemic and a piece of malware — a thoroughly modern ending for a thoroughly nineteenth-century institution.
Lessons
- A tuition-dependent college with no endowment cushion cannot absorb a lost enrollment cycle; the reserve other institutions take for granted is the difference between surviving a bad year and closing.
- Treat cybersecurity as solvency, not IT housekeeping — for a fragile institution, an attack that paralyzes recruitment and fundraising during the decisive months can be fatal, whatever the ransom.
- Protect and back up the systems that run admissions and recruitment above all; they are the lifeline of a tuition-dependent college, and losing access to them during the recruiting window is losing the year.
- Do not mistake an emergency appeal for a rescue plan; crowdfunding closes affection gaps, not structural deficits, and a college betting on a viral plea has already exhausted its real options.
- When a minority-serving college that anchors a region closes, the loss is concentrated on the students with the fewest alternatives; regulators and systems should weigh that disproportionate harm, not just the balance sheet.