{
  "type": "bundle",
  "id": "bundle--4a19085c-9418-5ad6-8d67-eb8b5b684ded",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--936b2d2f-c0e9-5929-894e-85c6229b09ff",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "org:35fd84a4-b97c-4983-97ae-e5ea9a8b53c4",
      "name": "Betterment",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--a7f993bb-a71b-5755-8fb9-b5dbeb567d4f",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "inc:226c3dee-a7d4-40ea-b4e8-99fb4c9f707e",
      "name": "January 2026 Betterment social-engineering incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--c70c42e2-659e-5071-86a1-2ed660679209",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "brh:244c4b6a-cdae-45d4-8e82-a81d59cb277e",
      "name": "Betterment social-engineering data breach"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06d69ac8-52f7-5028-844b-1ad8035e19eb",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:2cbef0f7-3902-4780-acd8-d2008e82af27",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--df8ea35c-caa1-511d-88be-52a80c264c24",
      "target_ref": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/customer-update",
          "external_id": "cit:b573178b-1811-427d-a865-f56b2be1144e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:5c0814bcb428dac6a081f3067746018e522a16232ff922f6ad7e08d36b26f2d8"
        },
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/Betterment",
          "external_id": "cit:5e4b5c58-8d74-47bd-b56d-bb6ea5c3dd27",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:04a30711e5451a4a58b15e2d9a43fac48a42014f595601358d39dc49f43ef8fc"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--441f9d4c-9d8d-56b5-820d-2808ede05a93",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:e3ea6cdc-3a46-4c1c-8f12-7ddf23e57dfa",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--df8ea35c-caa1-511d-88be-52a80c264c24",
      "target_ref": "x-ally-data-category--aeafc725-b7e8-584a-8554-622f2b1e7f3f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/Betterment",
          "external_id": "cit:43897467-e84a-4c6c-9133-a514cbbf0230",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:04a30711e5451a4a58b15e2d9a43fac48a42014f595601358d39dc49f43ef8fc"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62920ac0-4609-5b69-8f56-a70580b8d228",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:b32cc672-2f84-4820-8710-551240ba423d",
      "relationship_type": "resulted-in",
      "source_ref": "incident--a7f993bb-a71b-5755-8fb9-b5dbeb567d4f",
      "target_ref": "x-ally-notification--d9ef76fc-83bb-50fb-8472-668f2df42890",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/customer-update",
          "external_id": "cit:2faeb973-6d01-4b99-9588-cb1a32c6c032",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:5c0814bcb428dac6a081f3067746018e522a16232ff922f6ad7e08d36b26f2d8"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5836d4a-783b-5d57-8316-d2c7e8a82ac3",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:536fdb1e-6aab-4438-9293-bb94244ad31e",
      "relationship_type": "affected-organization",
      "source_ref": "incident--a7f993bb-a71b-5755-8fb9-b5dbeb567d4f",
      "target_ref": "identity--936b2d2f-c0e9-5929-894e-85c6229b09ff",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:50381957-b87b-476f-8af2-695062af3c46",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c939553a-866a-5f0f-8eda-35d17f26fd99",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:0ddbd8b5-43bb-43a0-887d-9647dd9c1d6f",
      "relationship_type": "resulted-in",
      "source_ref": "incident--a7f993bb-a71b-5755-8fb9-b5dbeb567d4f",
      "target_ref": "x-ally-data-exposure--df8ea35c-caa1-511d-88be-52a80c264c24",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:c6f460d7-6722-4956-995d-34b3776d36d8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cceba128-3a5b-55b9-83cf-17cf94eb7a8f",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:b07e24e3-de12-430a-8861-316366e2b607",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--df8ea35c-caa1-511d-88be-52a80c264c24",
      "target_ref": "x-ally-data-category--772969d5-39f4-5aa9-8123-4f12a64d1594",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/Betterment",
          "external_id": "cit:2c8a0581-6506-446a-a3da-71c5cc079fbc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:04a30711e5451a4a58b15e2d9a43fac48a42014f595601358d39dc49f43ef8fc"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ccfebe11-8c14-5342-8edd-e9636ad3fbd2",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:f65de9e1-4bd5-4a85-8afb-289744dfda2d",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--df8ea35c-caa1-511d-88be-52a80c264c24",
      "target_ref": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:85a44d3f-216d-4592-9b6e-8ed73aff6df0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        },
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/Betterment",
          "external_id": "cit:888e7a14-7b58-4396-a753-36fc4854d2c9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:04a30711e5451a4a58b15e2d9a43fac48a42014f595601358d39dc49f43ef8fc"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d2cb2c1b-a242-5cf3-807d-ead4fdaddab5",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:5f2fe4da-67a4-4030-83ee-fd8337891ee1",
      "relationship_type": "affected-organization",
      "source_ref": "x-ally-data-exposure--df8ea35c-caa1-511d-88be-52a80c264c24",
      "target_ref": "identity--936b2d2f-c0e9-5929-894e-85c6229b09ff",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:1527e001-fe74-4740-9ceb-619bf920a5c5",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc6e1f10-673c-5be9-87d0-f74b0b7064cf",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:9fb3b618-29ce-4640-9479-0abc1269cb75",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--df8ea35c-caa1-511d-88be-52a80c264c24",
      "target_ref": "x-ally-data-category--e88abdf1-a199-5c86-80c5-317bfbf871a1",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/Betterment",
          "external_id": "cit:f7f08c00-188b-4917-9bae-5666fde0eb18",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:04a30711e5451a4a58b15e2d9a43fac48a42014f595601358d39dc49f43ef8fc"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f3f83278-6821-555d-8e90-b4d3d99dd439",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:b85d2e19-e087-4ceb-836e-3a9946464295",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--df8ea35c-caa1-511d-88be-52a80c264c24",
      "target_ref": "x-ally-data-category--ff2c8174-4feb-535f-8a4d-be23ee26eff2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/customer-update",
          "external_id": "cit:2346c608-96ff-4d01-a09d-dc7a5a6a043c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:5c0814bcb428dac6a081f3067746018e522a16232ff922f6ad7e08d36b26f2d8"
        },
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/Betterment",
          "external_id": "cit:ce2e2ee8-b05b-402d-8938-98b7423b8905",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:04a30711e5451a4a58b15e2d9a43fac48a42014f595601358d39dc49f43ef8fc"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0e6196d5-0623-5ac5-88d8-ece0ec933ef9",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:2f37e8aa-a6bd-4b7c-ab9d-1a70444c3592",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:83e2af7f-c372-4395-91b1-08c2e3a8cc98",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "datetime",
        "value": "2026-01-09T18:18:00-05:00"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--335b56dc-a95b-53ef-8938-6a7ae64ba8cd",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:f72cc8ce-7656-40c7-811f-695cc72ebfa3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:ddfb1e1e-910e-4fea-8d89-acb522f83966",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Betterment said customer-account and transaction systems were not impacted and that no customer accounts, passwords, or login information were compromised."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6e73a711-82af-5c16-8db6-1119775a2cae",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:05690a4f-6aab-457d-aed6-03ddb1bc6fdd",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:cea8f7c5-5fe5-4008-a8b8-168094419ec3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "On January 12, Betterment received communications from a criminal group demanding a cryptocurrency payment; Betterment said it consulted professional advisers and law enforcement and decided not to engage with the group."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7fb36284-209e-5e14-8b64-e13f9aab6822",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:b481f8dd-ff79-4a5a-ab21-75b2475eeaf0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:a6f819e3-64e7-4378-96f0-8b5a260caded",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "integer",
        "value": 1400000,
        "unit": "individual",
        "approximate": true
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8a18b6cc-b6d7-501b-81dd-4d80e927bae1",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:37d2798d-c9c2-4880-943d-8ff9d4945730",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:999952a6-fc69-4b50-9bd9-47159b655f52",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "datetime",
        "value": "2026-01-09T13:31:00-05:00"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--aa01cd0e-32b7-5bff-8814-ba335b737e3b",
      "created": "2026-08-09T18:00:00Z",
      "modified": "2026-08-09T18:00:00Z",
      "x_ally_original_id": "clm:31a2f8df-72bf-4de9-a7e8-911d1acb2aa8",
      "confidence": 95,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1566/004/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b322a0cb-cdba-5112-81c5-8fe8f794de32",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:85f41873-bc28-4884-bac9-7b27141bdf71",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:1e10e9e6-4f00-41fb-b837-e95527767f6d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Betterment said data originating from the incident was temporarily published to a since-removed leak site on January 23, 2026."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b6bae961-3b4b-553b-8355-cc9bdde9264b",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:fafe12fd-6d9e-4642-89be-9597e21b79d0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/Betterment",
          "external_id": "cit:6b79d450-6724-4361-9ccf-9f2749bf5986",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:04a30711e5451a4a58b15e2d9a43fac48a42014f595601358d39dc49f43ef8fc"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "integer",
        "value": 1435174,
        "unit": "record"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c891dede-26b5-513f-8b3d-5b82eb91809b",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:369b1789-4a32-4876-b565-c045acee3f19",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:2631856f-c57a-46a0-a1be-44d063c60c21",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "datetime",
        "value": "2026-03-30T11:13:32-04:00"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d6ae2d3c-ada6-5d62-84ed-e4d322ff2a6d",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:e8dd5134-ab4e-483d-8d14-a50301b31c72",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:dfdaa133-a3f4-4db9-a146-2d3e08f80915",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Betterment strengthened MFA by retiring remaining non-hardware methods, tightened authenticator enrollment, enhanced monitoring and alerting, reinforced phishing training, and deployed additional denial-of-service protection."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--da34c248-2cb4-54b0-811f-b0337bd03623",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:26be3b47-6a95-4ec7-90c1-5766ffd67c49",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:1e0855fc-7961-4706-b161-28e4eee7eab9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Betterment reported that falsified caller ID and a voice-phishing kit were used to obtain employee credentials and a multi-factor authentication one-time passcode, register a new device, and access its Okta single-sign-on portal and several marketing and operations applications."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--dc49a368-ca21-5d79-8a91-eb3d4b3a6da2",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:86555e38-ade3-4fd5-b523-1e7e7ebfd40f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:24e41728-e2a6-4284-bc9c-72cebeed79dd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Betterment said the threat actor did not establish persistence, move laterally, escalate privileges, or affect system integrity during the January 9 access."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e315d40c-dd3e-5889-808a-b4188d5e5130",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:7fb43609-04c8-4120-b147-b6b66f68d438",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:73c31a4d-1792-4721-a30c-2c29ffb9cc9f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "datetime",
        "value": "2026-01-09T19:00:00-05:00"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ee6a4779-0070-5219-8dd4-53bf321b07b5",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:85290910-675c-4f28-bfdf-54154f3e80e2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:21035b4d-9c8d-424c-8de5-9120a28333d4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "datetime",
        "value": "2026-01-12T10:00:00-05:00"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ff4483ce-3cd0-5d47-887f-f74214706407",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "clm:79a199ea-8515-46af-bac0-8ece0805b30f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Betterment",
          "url": "https://www.betterment.com/resources/security-incident-report-january-2026",
          "external_id": "cit:68c9b0ac-bcb8-4fab-986c-0fd56534bc2d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d1bb121db572037d459a4e7946434e63dce99bd7144b3b649e10ce0e82fb6e3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The threat actor sent a fraudulent crypto offer to approximately 460,000 customers by email and mobile push notification; Betterment said it alerted recipients and made those who suffered losses from the offer whole."
      }
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--772969d5-39f4-5aa9-8123-4f12a64d1594",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "dat:68fb21c1-b8d3-41b3-acf6-93b7fd596c53",
      "name": "Employment information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:559cf3f5-80c7-45ba-a930-ff0bfa8d17b0",
      "name": "Names"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--aeafc725-b7e8-584a-8554-622f2b1e7f3f",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "dat:5ef441b8-53d7-47b1-8ed2-106fa0a7d239",
      "name": "Device information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:5abcee7e-4a37-494a-b6ba-87ff46149be9",
      "name": "Contact information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--e88abdf1-a199-5c86-80c5-317bfbf871a1",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "dat:92d8b8c7-0cde-4440-ae01-6c6fef5524d9",
      "name": "Geographic location information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--ff2c8174-4feb-535f-8a4d-be23ee26eff2",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:ad54319a-bb47-40fb-be6c-7fd6e2aa1f68",
      "name": "Dates of birth"
    },
    {
      "type": "x-ally-data-exposure",
      "spec_version": "2.1",
      "id": "x-ally-data-exposure--df8ea35c-caa1-511d-88be-52a80c264c24",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "exp:cf211995-f97f-48c7-82be-470652f3c7cb",
      "name": "Betterment customer and business-contact data exposure"
    },
    {
      "type": "x-ally-notification",
      "spec_version": "2.1",
      "id": "x-ally-notification--d9ef76fc-83bb-50fb-8472-668f2df42890",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "ntf:b982d115-df49-4ac2-b227-a85dc28a9941",
      "name": "Betterment January–March 2026 incident communications"
    }
  ]
}