{
  "type": "bundle",
  "id": "bundle--74fde6c4-de78-5e42-8696-b014af21815a",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--0e1edf34-69b2-54b7-86a9-c2dbe407982a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:8d71565c-e765-5234-8dc8-c7b8937b8147",
      "name": "Ardent Health Services",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--3d3045c0-5c85-56a4-8a2d-52c1bca17d8b",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:dde7cc70-1b8b-5f79-a681-49c69346db09",
      "name": "Ardent Health Services security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--64625834-ace7-59c4-873f-eb21f062c4aa",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:b08c0a53-bf3b-54be-b9da-ba066275306a",
      "name": "Ardent Health Services security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b331121-1967-59a5-8702-e1c99e039b4d",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:aef0ffe7-d2ba-5b6f-b13b-7852a534cc60",
      "relationship_type": "affected-organization",
      "source_ref": "incident--3d3045c0-5c85-56a4-8a2d-52c1bca17d8b",
      "target_ref": "identity--0e1edf34-69b2-54b7-86a9-c2dbe407982a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Ardent Health Services",
          "url": "https://ardenthealth.com/our-stories/ardent-health-services-reports-information-technology-security-incident",
          "external_id": "cit:07574925-f0a8-5533-bfa9-c86c37c60963",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6885636c65722d2ad9566954b360fed895c12be5c17cf7181f2e8e8655bc606f"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7d98cf83-424e-518c-81ab-caf3b313177a",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:c85d7c0b-c480-5c63-be63-8e83aa745016",
      "confidence": 84,
      "external_references": [
        {
          "source_name": "Ardent Health Services",
          "url": "https://ardenthealth.com/our-stories/ardent-health-services-reports-information-technology-security-incident",
          "external_id": "cit:ed76a716-34d7-53af-911e-4c2a8f2e1ddd",
          "description": "In an abundance of caution, our facilities are rescheduling some non-emergent, elective procedures and diverting some emergency room patients to other area hospitals until systems are back online.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6885636c65722d2ad9566954b360fed895c12be5c17cf7181f2e8e8655bc606f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ER patients diverted across multiple states."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a5fe619d-f9aa-5402-8812-4766bf98448a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:1eabb6d3-6423-5bae-b1f9-d475030c76ab",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Ardent Health Services",
          "url": "https://ardenthealth.com/our-stories/ardent-health-services-reports-information-technology-security-incident",
          "external_id": "cit:724dc5e2-0a90-500e-ae66-ee9e7a93e21d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6885636c65722d2ad9566954b360fed895c12be5c17cf7181f2e8e8655bc606f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the ardent health services security incident involving Ardent Health Services."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ca466ba8-35b3-5ac0-8e4c-7ae2872a96c2",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:41867803-e9f9-5bcd-8378-2d072c1dcf0e",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1486/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ecb47afa-0faf-5101-8e4b-f39911ef1ba3",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:16d6f0ac-bd1e-5c71-ad0c-94de32a35cd2",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "Ardent Health Services",
          "url": "https://ardenthealth.com/our-stories/ardent-health-services-reports-information-technology-security-incident",
          "external_id": "cit:44134d38-0603-5976-a953-80afd3431af3",
          "description": "Nashville, Tenn. (Nov. 27, 2023) – Ardent Health Services and its affiliated entities (“Ardent”) became aware of an information technology cybersecurity incident on the morning of November 23, 2023, which has since been determined to be a ransomware attack.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6885636c65722d2ad9566954b360fed895c12be5c17cf7181f2e8e8655bc606f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Ransomware."
      }
    }
  ]
}