{"id":458227,"date":"2026-09-09T13:02:08","date_gmt":"2026-09-09T13:02:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/us-ca\/458227\/"},"modified":"2026-09-09T13:02:08","modified_gmt":"2026-09-09T13:02:08","slug":"uc-berkeley-reports-sweeping-eecs-cyber-incident-to-law-enforcement-campus","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us-ca\/458227\/","title":{"rendered":"UC Berkeley reports sweeping EECS cyber incident to law enforcement | Campus"},"content":{"rendered":"<p>For two weeks, researchers and students in the electrical engineering and computer sciences department at UC Berkeley have been left in the dark concerning a massive and ongoing cybersecurity incident.<\/p>\n<p>UC Berkeley is still investigating the incident and officials have told\u200b\u200b The Daily Californian that law enforcement has been notified. While most EECS systems are now operational, some remain inactive as campus IT personnel work to fully restore the network.<\/p>\n<p>The outage began Aug. 25, when all EECS Instructional &amp; Research Information Systems, or IRIS, infrastructure was knocked offline.<\/p>\n<p>\u201cWe are aware that all IRIS services are currently down. More information will be forthcoming as it becomes available,\u201d wrote campus IT administrator Lars Rohrbach in an outage notice posted that day.<\/p>\n<p>Campus spokesperson Janet Gilmore later told the Daily Cal in an email that campus began \u201ccontainment efforts\u201d the following day \u2014 claiming campus IT then took down \u201cseveral systems\u201d as part of a \u201ccomprehensive security protocol.\u201d<\/p>\n<p>Alongside teaching, professors and researchers in the EECS department conduct some of UC Berkeley\u2019s most advanced research into AI and machine learning, with some projects funded by multimillion-dollar grants from the U.S. Department of Defense.<\/p>\n<p dir=\"ltr\">More than a week after the start of the incident, on Sept. 2, UC Berkeley\u2019s Information Security Office posted the first update to the situation, stating campus had \u201crecently identified suspicious activity\u201d using the university\u2019s cyberthreat identification and response software, <a href=\"https:\/\/www.dailycal.org\/news\/uc\/single-point-of-failure-uc-faculty-push-back-against-systemwide-cybersecurity-mandate\/article_28cdf6ff-4171-4045-9d59-cf735b8131e4.html\" rel=\"nofollow noopener\" target=\"_blank\">Trellix EDR<\/a>.\u00a0<\/p>\n<p dir=\"ltr\">Since the Daily Cal first <a href=\"https:\/\/www.dailycal.org\/news\/campus\/uc-berkeley-takes-eecs-systems-offline-after-detecting-suspicious-activity\/article_63e0a499-a3e6-46c4-883b-44e57721bb4b.html\" rel=\"nofollow noopener\" target=\"_blank\">reported<\/a> the outage last Friday,\u00a0campus administration has refused to provide details about the known scope or severity of the incident and continues to avoid referring to it as a hack or cyberattack.\u00a0<\/p>\n<p>Gilmore did confirm that UC Berkeley reported the incident to \u201claw enforcement\u201d; however, she declined to name the specific agency or investigative body.<\/p>\n<p>Most details about the incident remain unclear, as campus administration has restricted access to information concerning the outage; even many high-ranking EECS researchers and administrators have been left without answers.<\/p>\n<p>One researcher, the director of a campus AI lab who was granted anonymity to speak freely on the topic, said he has not been briefed about the incident and was stonewalled when he tried to look into it.<\/p>\n<p>\u201cI asked, \u2018Can you tell me?\u2019, and (an IT staffer) said, \u2018I\u2019m sorry. I\u2019m not at liberty to say,\u2019\u201d the director said. \u201cThat\u2019s the first time that anyone has ever said those words to me (at UC Berkeley) \u2026 That suggests that (the staffer) would get in trouble if they said something.\u201d<\/p>\n<p>Gilmore has said UC Berkeley is investigating the \u201cscope and potential impact\u201d of the incident and claimed the activity has not been linked to any \u201cknown threat actors.\u201d<\/p>\n<p>Some of the systems affected, according to sources familiar with the outage, were large data centers aiding advanced AI research. This includes computers located in Warren Hall powering the Savio computing cluster. Savio has endured protracted compute and storage issues since April, and in July required an \u201curgent security update.\u201d<\/p>\n<p>IRIS oversees a wide range of campus IT infrastructures, including access to computing resources, research servers and student learning environments. Rohrbach\u2019s original outage note referenced four services by name: Home Directory Storage, IRIS Website, Project Storage and Unix Login Server.<\/p>\n<p>It is unclear if any student or staff\u2019s personally identifiable information was affected; Gilmore did not say whether any data had been exfiltrated from EECS servers or what methods an attacker may have used.<\/p>\n<p>\u201cThere\u2019s something here that would reflect poorly on the university \u2014 that\u2019s my guess,\u201d the director said. \u201cBut of course, this is exactly what they don\u2019t want, right? They don\u2019t want speculation.\u201d<\/p>\n<p>The Daily Cal reached out to several EECS researchers and professors to investigate this incident, all of whom either declined to comment or reported a similar lack of knowledge.<\/p>\n<p>The AI lab director said while access to research environments was affected for some time as their internal data centers were taken offline, most operations were either quickly restored or moved to external providers like Amazon Web Services.<\/p>\n<p>The director\u2019s AI lab does not conduct \u201cexport-restricted\u201d research, work that is quarantined by the government from being shared on publicly accessible systems. Other labs on the EECS network, he said, likely do conduct this kind of research, particularly those working on projects sponsored by the U.S. government, especially the military.<\/p>\n<p>\u201cSome pages on our main website are still down (faculty homepages, etc.) but most services have been restored and IT has a process in place to assist any individuals who may continue to have issues,\u201d Gilmore said in an email Tuesday. \u201cRestoration is continuing, and most systems vital to research have been restored.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"For two weeks, researchers and students in the electrical engineering and computer sciences department at UC Berkeley have&hellip;\n","protected":false},"author":2,"featured_media":458228,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[2007,15163,764,41281,41294,86529,48514,180771,113529,180778,180774,180772,180779,16155,180773,143,145,144,180780,180777,23221,180775,64363,149,180781,180776],"class_list":["post-458227","post","type-post","status-publish","format-standard","has-post-thumbnail","category-oakland","tag-ai","tag-amazon-web-services","tag-berkeley","tag-cyberattack","tag-cybersecurity-incident","tag-daily-cal","tag-eecs","tag-eecs-instructional-research-information-systems","tag-hack","tag-home-directory-storage","tag-information-security-office","tag-iris","tag-iris-website","tag-janet-gilmore","tag-lars-rohrbach","tag-oakland","tag-oakland-headlines","tag-oakland-news","tag-project-storage","tag-savio","tag-the-daily-californian","tag-trellix","tag-u-s-department-of-defense","tag-uc-berkeley","tag-unix-login-server","tag-warren-hall"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/458227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/comments?post=458227"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/posts\/458227\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media\/458228"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/media?parent=458227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/categories?post=458227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ca\/wp-json\/wp\/v2\/tags?post=458227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}