{"resourceId":"dailycal-berkeley-eecs-iris-cyber-incident-20260909","versions":[{"version":"external-5917e24dff7b0817fd5b4f4cdc2f9c447809669cbd7621fdc3156ce45719b4da","resource":{"id":"dailycal-berkeley-eecs-iris-cyber-incident-20260909","title":"Daily Cal: UC Berkeley EECS researchers left in dark after sweeping IRIS cybersecurity incident","organization":"The Daily Californian","sector":"Higher education campus journalism / cybersecurity incident reporting","geography":"United States (University of California, Berkeley)","publishedAt":"September 9, 2026","publicationDate":"2026-09-09","eventDate":"2026-08-25","sourceName":"The Daily Californian","sourceLabel":"Campus independent reporting on EECS IRIS outage and communications gaps","sourceUrl":"https://www.dailycal.org/news/campus/uc-berkeley-ai-researchers-left-in-dark-following-sweeping-eecs-cybersecurity-incident/article_7f60ce15-c13c-4d6e-9f83-8db8fd83f0e2.html","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["data-security","operating-model","governance-procurement","accessibility-workforce"],"finding":"Campus reporting states that from about Aug. 25, 2026, EECS Instructional & Research Information Systems (IRIS) infrastructure was taken offline amid suspicious activity; containment restricted network access and systems. As of the Sept. 9 article, investigation continued with law enforcement notified; most EECS systems restored but some inactive; central campus IT said unaffected; detection attributed to endpoint detection and response. An anonymous AI lab director described limited briefings and research disruption with partial migration to AWS. Why now: post-dates last published campus-operations edition’s source set and remains newly relevant to mid-September restoration/comms scrutiny; URL not in archive.","sledRelevance":"Cautionary campus-operations evidence on research-IT cyber response, continuity for AI labs, stakeholder communication failures, and EDR-triggered containment tradeoffs—not a product pitch.","evidence":"Primary Daily Cal HTTPS article with dated quotes from campus IT notices and spokesperson Janet Gilmore; anonymous researcher commentary. Scope of data exfiltration and threat actor remain undisclosed in the piece.","architectureImplications":"Segment research/instructional department infrastructure from central services; plan alternate pathways (including cloud) when IRIS-like platforms are contained; ensure EDR coverage without assuming zero research downtime.","governanceImplications":"Incident communications to faculty researchers and IT administrators need clearer briefings beyond outage notices; law-enforcement involvement and FOIA/comms strategy should be pre-planned for high-visibility AI research units.","securityPrivacyImplications":"Unclear whether PII was affected; export-restricted research labs increase sensitivity of any compromise. Containment protected systems but created multi-week operational fog.","caveats":"Student newspaper reporting with anonymous sources; university declined many details. Not a forensic report. Clarification note in page HTML appears mistyped (07/09/2026) relative to Sept dateline—treat operational claims cautiously.","streamIds":["campus-operations"],"roles":{"sales":"This is a cautionary incident narrative, not a buying guide. Use it to open discovery on research-IT segmentation, EDR coverage, and faculty incident communications—not to promise prevention. Bound any follow-on to tabletop and continuity design; never claim the article proves a specific vendor failure or success.","engineering":"Probe IRIS-like departmental platforms for blast-radius, EDR telemetry, and failover to cloud identity/storage. Prerequisites: asset inventory for research systems and pre-authorized alternate access. Constraints: public facts incomplete. Proof of value is a tested continuity path and comms runbook under simulated containment.","delivery":"Delivery work is incident-ready operating model: dual departmental/central command, researcher briefing cadence, and restoration prioritization that includes research as well as instruction. Ownership: CISO with EECS/research IT. Acceptance criteria: named continuity contacts and documented alternate pathways. Risks: over-containment without comms erodes trust."},"roleDetails":{"sales":{"customerProblem":"AI/research units can be dark for weeks during containment when departmental IT and central security communications misalign.","stakeholders":["CISO","Research IT / IRIS equivalents","Dean/EECS leadership","Communications","Faculty PIs"],"discoveryQuestions":["Who briefs research PIs during containment beyond outage banners?","Which research systems have tested cloud failover?","Is EDR coverage complete across departmental research hosts?","How is export-controlled research isolated?"],"valueHypothesis":"Clearer segmentation and continuity playbooks can reduce research downtime and uncertainty during EDR-driven containment—this article does not measure that improvement.","potentialEngagement":"Tabletop exercise on departmental research-IT cyber containment and faculty communications.","unsupportedClaims":["Attribution of attacker or confirmed data theft","Proof that any specific security product failed","Quantified research productivity loss"]},"engineering":{"fit":"Relevant to any campus with departmental research computing distinct from central IT.","architectureIntegration":"Segment IRIS-like stacks; pre-stage alternate identity/storage (e.g., cloud) for research continuity; ensure EDR does not become a single point of opaque decision-making.","prerequisites":["Current asset/service inventory","Documented network containment playbooks","Research data classification including export controls"],"constraints":["Public reporting lacks forensic detail","Law-enforcement involvement may limit disclosure"],"security":"Balance rapid containment with evidence preservation and need-to-know briefings for system owners.","proofOfValue":["Successful failover test for a research home-directory or project store","Comms checklist executed in tabletop within defined hours","Clear RACI between departmental IT and central ISO"]},"delivery":{"work":"Build/refresh incident comms templates, alternate access guides, and restoration priority lists covering research systems.","dependencies":["Central ISO","Departmental IT","Cloud providers","University communications","Legal"],"ownership":"CISO leads incident; departmental IT owns service restoration with faculty liaison roles.","skillsAdoption":"Train research IT and PI proxies on workaround procedures and escalation paths.","governanceCheckpoints":["Law-enforcement notification decision log","Daily stakeholder briefing during multi-week events","Post-incident review with faculty representation"],"acceptanceCriteria":["Named PI briefing owner","Alternate access documentation published to affected units","Restoration status visible beyond internal IT channels"],"risks":["Trust loss from information blackouts","Shadow IT during outages","Incomplete understanding of export-controlled exposure"]}},"retrievedAt":"2026-09-21T22:06:20-05:00","enrichedAt":"2026-09-21T22:08:00-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Faculty/staff faced workarounds and information gaps; instructional continuity was prioritized for restoration, but research staff bore uncertainty and alternate-access labor.","procurementImplications":"EDR tooling (named Trellix in tagging/context of related campus materials) and cloud failover capacity become visible cost/ops dependencies during department-scale incidents.","operatingModelImplications":"Departmental IRIS ownership vs central ISO response creates coordination and communications seams; AI research units need predefined continuity owners during containment.","sourceVerification":{"openedUrl":"https://www.dailycal.org/news/campus/uc-berkeley-ai-researchers-left-in-dark-following-sweeping-eecs-cybersecurity-incident/article_7f60ce15-c13c-4d6e-9f83-8db8fd83f0e2.html","referenceExcerpt":"For two weeks, researchers and students in the electrical engineering and computer sciences department at UC Berkeley have been left in the dark","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}