{
  "type": "bundle",
  "id": "bundle--341c8c12-2653-555e-8ae7-f42dca47cf5b",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--52f11ccc-a671-5e2c-87af-192c3b58e35c",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "org:d75905b0-0c42-4b26-b8eb-e8dae71734ba",
      "name": "Blossom BH Opco Inc.",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--665f129d-1600-5193-8c22-6cbb76c75796",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "inc:9f31b49f-538f-4736-a403-f70628d2e7b5",
      "name": "Blossom Health EHR phishing incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--b20a0936-baec-5848-8445-762415309254",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "brh:2d07d273-1943-471f-8c4e-fe735e3f8e75",
      "name": "Blossom Health EHR phishing incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14b9377b-e3b5-5846-88a9-6ca8d5751d4e",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:b3d7dbe3-c240-48ea-92a5-5cfe89a08e9d",
      "relationship_type": "resulted-in",
      "source_ref": "incident--665f129d-1600-5193-8c22-6cbb76c75796",
      "target_ref": "x-ally-event--8dc78da6-4991-5a1f-8296-752c24e094c4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:110d1dd8-7cb0-4e96-8dc8-3bf99c28cd52",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bfa4c402-0d7a-548c-8ded-8267ae9e0481",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:ffca0ee9-4829-4e7a-be0c-dca34f1195d3",
      "relationship_type": "affected-organization",
      "source_ref": "incident--665f129d-1600-5193-8c22-6cbb76c75796",
      "target_ref": "identity--52f11ccc-a671-5e2c-87af-192c3b58e35c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:6a883cd9-475b-472b-98c1-ff6ddf494d8a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2f2ae87-7cbc-56e6-8155-ce8625dabcf7",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:6c2ff1a7-82b1-4345-90d1-57b08351de8e",
      "relationship_type": "resulted-in",
      "source_ref": "incident--665f129d-1600-5193-8c22-6cbb76c75796",
      "target_ref": "x-ally-event--23d76c45-f308-55b1-8bae-0fdfb10a8df8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:0ddba06c-2730-42f1-95ab-a7d62165227c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3582b302-f2a7-502e-8ac3-427d6f9bc2da",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:0cbb9193-d545-4cb2-ae75-1b5dcf92f0a8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:b70b8e2b-3ef5-4df9-aad3-52010e6787f6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Blossom removed access, changed passwords and added security measures. Its notice offered monitoring services."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--639bfc6f-14ba-52eb-8a6a-185803207cbd",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:3f79e241-1988-41a7-b096-2e1694da03d9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:d521f0d0-0525-4271-9164-76e2463327a7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The company traced entry to phishing of a non-employee contractor and removed the actor after detecting access."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6c2cad91-40a7-59f2-82d5-0eae04a8e8f2",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:b2e79246-7af3-4daa-b603-f30c7f5e5803",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:90822aaa-5702-4219-a4c1-321e396493b4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Viewed information could include patient names, contact details and health-insurance information. Blossom said Social Security numbers and payment-card information were not accessible."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--71ccaad4-60eb-514b-8a5f-d22105f19eee",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:be93cff9-31b0-4377-952b-bc11a78e6dd4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:a4bfc5b6-c06d-4701-a33a-9d8160d59c55",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-29"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7cf1f46d-c048-5b3a-8024-89eb5b9cc144",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:c04c66f1-4d0f-4bfa-acdb-408853e0669e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:bface334-4db4-446a-ac70-a881b814a97c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Blossom BH Opco Inc. reported that an unauthorized actor accessed its electronic health-record system on August 27, 2026."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7f895032-fe48-5c78-87bf-9c7e7557ad5a",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:484c5bc1-b46d-4f9f-8cce-11726cfe80c0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:f5ab2163-4b23-461a-afe1-8be84a43e184",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-08-27"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a2deb0c6-b184-50a6-878a-19cb682880ab",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:6f8a3a05-7dec-40bc-bbee-df5d71cfa573",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1566/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--bb30db60-f044-5f04-81e0-ed108dfd50d1",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:9d54d1cc-2404-4073-8843-2a64888d28cb",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Blossom BH Opco Inc.",
          "url": "https://oag.ca.gov/system/files/CA%20AG%20Letter%20-%20Blossom%20Health_0.pdf",
          "external_id": "cit:02d16b3e-4829-4b83-b360-5305f9ed4089",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6f88b398e4481a036c84ea0802f9afdac728d6417b0316c7680c990521b6e63c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-08-27"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--23d76c45-f308-55b1-8bae-0fdfb10a8df8",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "evt:11450b5c-2dbb-4160-94d4-7e2f5defef1f",
      "name": "Notification letter dated"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--8dc78da6-4991-5a1f-8296-752c24e094c4",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "evt:464cfff4-0e1f-4789-b127-c285cedca446",
      "name": "Unauthorized EHR access detected and removed"
    }
  ]
}