From the Campus Operations edition of September 21, 2026
Daily Cal: UC Berkeley EECS researchers left in dark after sweeping IRIS cybersecurity incident
The Daily Californian · Higher education campus journalism / cybersecurity incident reporting · United States (University of California, Berkeley)
- Publisher
- The Daily Californian
- Original publication
- September 9, 2026
- Source retrieved
- 2026-09-22
- Event date
- 2026-08-25
What happened
Campus reporting states that from about Aug. 25, 2026, EECS Instructional & Research Information Systems (IRIS) infrastructure was taken offline amid suspicious activity; containment restricted network access and systems. As of the Sept. 9 article, investigation continued with law enforcement notified; most EECS systems restored but some inactive; central campus IT said unaffected; detection attributed to endpoint detection and response. An anonymous AI lab director described limited briefings and research disruption with partial migration to AWS. Why now: post-dates last published campus-operations edition’s source set and remains newly relevant to mid-September restoration/comms scrutiny; URL not in archive.
Why it matters
Cautionary campus-operations evidence on research-IT cyber response, continuity for AI labs, stakeholder communication failures, and EDR-triggered containment tradeoffs—not a product pitch.
Evidence and measured results
Primary Daily Cal HTTPS article with dated quotes from campus IT notices and spokesperson Janet Gilmore; anonymous researcher commentary. Scope of data exfiltration and threat actor remain undisclosed in the piece.
Limitations and uncertainty
Student newspaper reporting with anonymous sources; university declined many details. Not a forensic report. Clarification note in page HTML appears mistyped (07/09/2026) relative to Sept dateline—treat operational claims cautiously.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-21; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- AI/research units can be dark for weeks during containment when departmental IT and central security communications misalign.
- Stakeholders
- CISO
- Research IT / IRIS equivalents
- Dean/EECS leadership
- Communications
- Faculty PIs
- Discovery questions
- Who briefs research PIs during containment beyond outage banners?
- Which research systems have tested cloud failover?
- Is EDR coverage complete across departmental research hosts?
- How is export-controlled research isolated?
- Value hypothesis
- Clearer segmentation and continuity playbooks can reduce research downtime and uncertainty during EDR-driven containment—this article does not measure that improvement.
- Potential engagement
- Tabletop exercise on departmental research-IT cyber containment and faculty communications.
- Unsupported claims
- Attribution of attacker or confirmed data theft
- Proof that any specific security product failed
- Quantified research productivity loss
Pre-sales engineering
Role takeaway
- Fit
- Relevant to any campus with departmental research computing distinct from central IT.
- Architecture and integration
- Segment IRIS-like stacks; pre-stage alternate identity/storage (e.g., cloud) for research continuity; ensure EDR does not become a single point of opaque decision-making.
- Prerequisites
- Current asset/service inventory
- Documented network containment playbooks
- Research data classification including export controls
- Constraints
- Public reporting lacks forensic detail
- Law-enforcement involvement may limit disclosure
- Security
- Balance rapid containment with evidence preservation and need-to-know briefings for system owners.
- Proof of value
- Successful failover test for a research home-directory or project store
- Comms checklist executed in tabletop within defined hours
- Clear RACI between departmental IT and central ISO
Delivery
Role takeaway
- Work
- Build/refresh incident comms templates, alternate access guides, and restoration priority lists covering research systems.
- Dependencies
- Central ISO
- Departmental IT
- Cloud providers
- University communications
- Legal
- Ownership
- CISO leads incident; departmental IT owns service restoration with faculty liaison roles.
- Skills and adoption
- Train research IT and PI proxies on workaround procedures and escalation paths.
- Governance checkpoints
- Law-enforcement notification decision log
- Daily stakeholder briefing during multi-week events
- Post-incident review with faculty representation
- Acceptance criteria
- Named PI briefing owner
- Alternate access documentation published to affected units
- Restoration status visible beyond internal IT channels
- Risks
- Trust loss from information blackouts
- Shadow IT during outages
- Incomplete understanding of export-controlled exposure
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Segment research/instructional department infrastructure from central services; plan alternate pathways (including cloud) when IRIS-like platforms are contained; ensure EDR coverage without assuming zero research downtime.
Governance
Who approves, reviews and stays accountable for outcomes?
Incident communications to faculty researchers and IT administrators need clearer briefings beyond outage notices; law-enforcement involvement and FOIA/comms strategy should be pre-planned for high-visibility AI research units.
Security and privacy
What data, permissions and controls need testing?
Unclear whether PII was affected; export-restricted research labs increase sensitivity of any compromise. Containment protected systems but created multi-week operational fog.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Faculty/staff faced workarounds and information gaps; instructional continuity was prioritized for restoration, but research staff bore uncertainty and alternate-access labor.
Procurement
What should contracts, pricing and exit terms secure?
EDR tooling (named Trellix in tagging/context of related campus materials) and cloud failover capacity become visible cost/ops dependencies during department-scale incidents.
Operating model
Which teams own the service once it runs?
Departmental IRIS ownership vs central ISO response creates coordination and communications seams; AI research units need predefined continuity owners during containment.
Publication history
- 2026-09-21Campus Operations · Issue 154 resources
Stable resource ID: dailycal-berkeley-eecs-iris-cyber-incident-20260909