{
  "type": "bundle",
  "id": "bundle--0a8a3513-70f6-5f2b-8c33-c530f65a3114",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c10ef423-7702-5d33-865e-fc0f694edcfb",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:a1f4bf4c-db00-5172-a10b-9fdcfc69679f",
      "name": "AT&T",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--18dcfe83-2700-55c2-8909-484b29d86a5e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:de99f848-3238-5d39-be3e-53b4e0c195ce",
      "name": "AT&T security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--4552a02e-9f58-5125-871f-843a44c203c2",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:8d5dfae5-74cc-598d-9809-0aedbff04669",
      "name": "AT&T security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--50642231-1192-519f-8313-ca1169261a32",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:f6ac2981-3df4-57de-837e-a8b69dc99ace",
      "relationship_type": "affected-organization",
      "source_ref": "incident--18dcfe83-2700-55c2-8909-484b29d86a5e",
      "target_ref": "identity--c10ef423-7702-5d33-865e-fc0f694edcfb",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm",
          "external_id": "cit:dc2f37c7-74ad-5a0d-a797-e21e5195efcb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:834fbde0e13c3a21ad9c43d72d0bdbeeea41ba676151b16867497322c442bc28"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1c662916-6b48-50e6-82be-e7b478ecea1f",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:98d5aa10-a062-588e-8de8-969a013a7c8e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm",
          "external_id": "cit:488de755-116a-58d9-8a4c-71eb17a67083",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:834fbde0e13c3a21ad9c43d72d0bdbeeea41ba676151b16867497322c442bc28"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the at&t security incident involving AT&T."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5aabfa2f-8835-53e6-8e46-2e2372c5c99f",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:c44b0c74-981e-5b00-9227-a142b137eb32",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1078/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--76a721c5-5c6a-5a76-80dc-bd3e5191ac8a",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:f0c6beda-0630-573a-b0c3-f6f5c312215d",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm",
          "external_id": "cit:3606e102-0a26-593d-9a6d-a2de06c95a3b",
          "description": "AT&T immediately activated its incident response process to investigate and retained external cybersecurity experts to assist.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:834fbde0e13c3a21ad9c43d72d0bdbeeea41ba676151b16867497322c442bc28"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes a forensic or specialist investigation of the incident."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d8743622-0fef-50c9-8d99-4e3d31793284",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:7514d3d7-4472-5743-bca5-c453dadbd5a1",
      "confidence": 82,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm",
          "external_id": "cit:721ed397-d027-5cc9-95f2-291a40750828",
          "description": "If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:834fbde0e13c3a21ad9c43d72d0bdbeeea41ba676151b16867497322c442bc28"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Stolen credentials were used against a Snowflake customer account that did not enforce MFA."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f852122a-739a-5188-83ac-298e9c6c86c5",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:8a40671a-7f5c-5ac5-8a37-b9f06dad8d9c",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm",
          "external_id": "cit:73462a9a-2d57-5cb8-9e03-29dfabb521a1",
          "description": "AT&T is working with law enforcement in its efforts to arrest those involved in the incident.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:834fbde0e13c3a21ad9c43d72d0bdbeeea41ba676151b16867497322c442bc28"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source reports coordination with law enforcement as part of the incident response."
      }
    }
  ]
}