Lincoln College was already struggling. Then came ransomware.

As Illinois’ Lincoln College approached its two-week winter hiatus last December, workers walked in one weekend to find printers spewing threatening notes saying the school’s data was locked up and could only be restored with a financial payment.

It was the start of a situation familiar to anyone who’s observed the onslaught of ransomware against the education industry over the past half-decade. But for Lincoln College, it was also a blow that came when the 630-student school was already reeling financially and on the brink of collapse.

The predominantly Black college is now set to close May 13, ending 157 years of operations. While the school had already fallen on hard economic times before the cyberattack, the ransomware seized up its networks and data just as it came time to process applications and figure out enrollment for the next academic year. By the time those systems were fully restored last month, it was too late, the college’s president, David Gerlach, told EdScoop.

“You can’t get your admissions applications into the system, you can’t recruit students,” Gerlach said. “We had the Common App available to us, so we were able to receive applications that way, but with internal systems being down, you’re out of operation for a month and a half.”

Already on hard times

A cyber insurance policy helped pay for legal advice, a small team of information-security specialists and a ransom payment — to a malicious actor reputedly based in Iran — that Gerlach said was “significantly” below the an initial $100,000 asking price. But the incident still led to Lincoln administrators being cut off for weeks from their institutional data, the college’s backbone for recruitment, retention and enrollment efforts.

Lincoln College was already on hard times. Gerlach’s 2015 decision to switch Lincoln from being a two-year school to one issuing four-year degrees was followed by the school’s $38 million endowment shrinking by half within a few years, the Chicago Tribune reported.

Enrollment went up though, reaching a record 756 students in fall 2019. The college anticipated enrollment would continue to grow to more than 900 by fall 2022. But many students who went home in March 2020 never returned after COVID-19. Admissions were further damaged by other events beyond the college’s control, like a 2019 Chicago Public Schools strike that cut off access to Lincoln’s biggest student-recruitment pool.

If Gerlach’s last-ditch plea for a $50 million donation doesn’t come through, the ransomware incident will be remembered as a final insult.

The college’s closure mirrors some of the struggles experienced by higher education, with 27 other colleges and satellite campuses around Illinois closing in recent years, according to the state Board of Higher Education. Gerlach also said that Illinois is one of the largest “exporters” of college students and that competing with nearby states only added to the difficulties.

“What Lincoln College is facing is not unsurprising,” he said. “You’re going to see a lot more lower- endowed colleges struggle through [these] issues in the next few years.”

Several universities around Illinois, including Illinois State University and Western Illinois University, have volunteered services for students looking to enroll when Lincoln closes. Those offers include advising to ensure credits transfer over correctly. Illinois Wesleyan University offered a tuition match for Lincoln College students.

A system outage… then a familiar number

Gerlach said the college was fully aware of the threat of ransomware, especially as many other colleges in-state and across the country announced temporary closures because of attacks.

Lincoln College’s IT director, Brian Peacher Sr., was appointed to that job in early December, just a few days before the ransomware was detected. According to Gerlach, Peacher’s predecessor had implemented some baseline security measures, like multi-factor authentication, but left for a new job before the fall 2021 semester.

Peacher, who’s also been serving as the director of career services since last September, did not respond to EdScoop’s request for comment. Gerlach also declined a follow-up interview for more details on the school’s IT policies.

The attack was detected Dec. 19, just in time for the winter break and the anticipation of a make-or-break admissions season. Gerlach and other Lincoln administrators spent that Sunday night on a 17-person Zoom call — facilitated by the college’s insurer — with lawyers and cybersecurity experts to discuss their options.

Gerlach declined to describe how the attackers infiltrated the college’s network. He did say that after being paid, the hackers provided a decryption key that failed to recover much of the ransomed data.

A second key provided by the hackers was more successful, allowing Lincoln College to bring additional systems back online in January and February. Projected enrollment numbers were finally available in mid-March, Gerlach said Enrollment was projected to stay flat at around 630 students for the third fall in a row, despite the college’s recruitment and retention efforts.

According to the college’s turnaround plan, those numbers were too low to continue.