Lincoln College

Summary

Lincoln College, a predominantly Black institution with 630 students, faced a ransomware attack during a period of significant financial distress. Threat actors compromised the institution's systems, locking critical data and demanding payment, which was discovered when printers began producing extortion notes. The cyberattack exacerbated existing financial challenges, ultimately contributing to the decision to permanently cease operations after 157 years. This incident marked one of the first documented cases where a ransomware event directly influenced an educational organization's closure.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Lincoln College experienced a ransomware attack in early December 2021, coinciding with preparations for its two-week winter hiatus. College staff discovered printers autonomously producing threatening messages stating the institution's data had been encrypted and would only be restored following a financial payment. This incident occurred amid existing financial instability at the 157-year-old institution, which served 630 students and was recognized as a predominantly Black college. The ransomware attack followed patterns observed in numerous education sector cyber incidents over the preceding five years, though specific technical details regarding infection vectors, data exfiltration, or encryption methods were not disclosed in available reports. No information was provided regarding whether the college engaged with threat actors, paid ransom demands, or successfully restored systems through alternative means.

The cyber incident compounded severe pre-existing financial challenges that had already placed the institution at risk of collapse. While the ransomware attack's direct operational impacts weren't detailed in source material, the college administration cited the cybersecurity event as a contributing factor in its ultimate decision to cease operations. Lincoln College officially announced its permanent closure on May 13, 2022, ending all academic functions. The institution's closure represented the loss of a historically significant educational establishment that had operated since 1865. No subsequent information was available regarding forensic investigations, law enforcement involvement, or recovery efforts undertaken between the December attack and the May closure announcement.

Sources

Sources available to members: 1 source.