Cyber Incident Victim: University of California, Irvine
Date:
Jan 2023
Location:
United States of America
Summary
Hackers infiltrated student-run Discord groups affiliated with a university in Irvine, California, posting graphic videos depicting human corpse desecration and animal mutilation. Approximately 3,000 users were exposed to the content, resulting in severe physical reactions including hospitalizations from vomiting and widespread sleep disturbances. The attack disrupted academic activities as the servers were critical for class communications and group projects. Perpetrators likely accessed the platforms using compromised student credentials and demanded a $1,000 ransom while taunting victims about the chaos caused, including one club deleting its server entirely. The institution clarified it does not oversee these privately managed platforms. Attackers indicated broader targeting of multiple educational institutions, suggesting motivations centered on attention-seeking behavior.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 4 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 9, 2023, hackers targeted student-run Discord groups affiliated with UC Irvine in Orange County, California, flooding them with pop-ups and posting graphic videos depicting human corpse desecration and animal mutilation. Approximately 3,000 users—including students and faculty—were exposed to the disturbing content during the cyberattack. The severity of the imagery reportedly caused multiple students to require hospitalization for excessive vomiting, while others experienced sleep disturbances. Alina Kim, a manager of several affected Discord servers, confirmed the attack disrupted academic activities, as many relied on these platforms for class communications, group projects, and coursework coordination. The hackers gained unauthorized access by likely purchasing a student’s login credentials, then demanded a $1,000 ransom payment. In a message following the attack, the perpetrators boasted about causing physical reactions, stating, "we made one poor bastard vomit," and noted that one club deleted its entire Discord server in response.
UC Irvine officials clarified they do not oversee the student-operated Discord servers, distancing the institution from direct responsibility for the incident. Kim collaborated with other server administrators to investigate the attack, speculating the hackers were indiscriminately targeting multiple educational institutions "for the attention" rather than singling out UC Irvine. The incident prompted lockdowns across the Discord network as administrators worked to contain further breaches. No evidence suggested data theft or malware deployment beyond the violent content dissemination and pop-up spam. The attackers’ primary impact centered on psychological harm, academic interference, and operational disruption to the unofficial communication channels critical to campus activities.