{
  "type": "bundle",
  "id": "bundle--5d4fa6e7-91d7-545e-8806-952c1372068b",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--17a9821f-ae2c-5e07-8fdd-5ae76815112d",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:eb83e608-f53a-544f-9578-0a5f0e7a0525",
      "name": "British Library",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--c4b3b8a8-fb9e-5f3d-82c8-564a06b982f0",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:6f5cc1e3-818f-56aa-a960-78608688f359",
      "name": "British Library security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--eb7db265-e6d1-55e9-81e2-42f320330302",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:6f004508-7973-5fdb-b274-3ea43942f099",
      "name": "British Library security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5bd98abf-e3a1-5a6b-8e1b-db41e687a14f",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:3ea503df-61d1-5d54-84a9-486f04500ed1",
      "relationship_type": "affected-organization",
      "source_ref": "incident--eb7db265-e6d1-55e9-81e2-42f320330302",
      "target_ref": "identity--17a9821f-ae2c-5e07-8fdd-5ae76815112d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "British Library",
          "url": "https://www.bl.uk/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf/british-library-cyber-incident-review-8-march-2024.pdf?dl=",
          "external_id": "cit:65e6750e-1098-55a5-9777-15a09f89a1a1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d8ed8ce0b0be4611bb0a60e2a36de8ac2bfe40f6dd4b881b9316fb66d1f035a"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--253aaa77-d2d6-5f3f-86a4-de654f27da1d",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:c1ccd49f-ff1a-5ff6-b892-8755b572da42",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "British Library",
          "url": "https://www.bl.uk/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf/british-library-cyber-incident-review-8-march-2024.pdf?dl=",
          "external_id": "cit:92e185f8-6f84-5e2e-b6e9-c0053018d5a0",
          "description": "The attack, which was claimed by the Rhysida ransomware gang, exfiltrated data, encrypted or destroyed substantial portions of our server estate, and forcibly locked out all users from our network.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d8ed8ce0b0be4611bb0a60e2a36de8ac2bfe40f6dd4b881b9316fb66d1f035a"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Rhysida ransomware."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--27a1370f-6912-5226-8e64-9b696858e1ab",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:54ea0385-4d74-5f43-85ef-2ae03d642fca",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1486/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5cba10af-5a70-57a0-8ee6-923c3807748e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:ad340078-f800-5249-964e-d53e70795e9d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "British Library",
          "url": "https://www.bl.uk/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf/british-library-cyber-incident-review-8-march-2024.pdf?dl=",
          "external_id": "cit:e4db8e58-ff74-5841-a229-8b2dd746256d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d8ed8ce0b0be4611bb0a60e2a36de8ac2bfe40f6dd4b881b9316fb66d1f035a"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the british library security incident involving British Library."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6e2835b6-8085-5210-8217-c3c9b330ac97",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:520f28a1-0e9c-51bc-9ba0-5e50ee8aaf9a",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "British Library",
          "url": "https://www.bl.uk/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf/british-library-cyber-incident-review-8-march-2024.pdf?dl=",
          "external_id": "cit:21ece896-c6ad-54ff-a407-7f5257976472",
          "description": "Executive Summary Pages 2-3 Section One Causality – understanding the attack Pages 4-8 Section Two Impact Pages 9-11 Section Three Crisis response and recovery Pages 12-13 Section Four Technology infrastructure Pages 14-15 Section Five Future risk assessment Pages 16 Section Six Learning lessons from the attack Pages 17-18",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d8ed8ce0b0be4611bb0a60e2a36de8ac2bfe40f6dd4b881b9316fb66d1f035a"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "£6-7M recovery."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e15c6183-9c3a-502e-84a2-ae99331d4248",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:69d464f9-b772-56ae-b35b-f2fd7b04e337",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "British Library",
          "url": "https://www.bl.uk/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf/british-library-cyber-incident-review-8-march-2024.pdf?dl=",
          "external_id": "cit:11549679-0a70-5d4e-aa87-40affbc07dfc",
          "description": "The Library’s vulnerability to this particular kind of attack has been exacerbated by our reliance on a significant number of ageing legacy applications which are now, in most cases, unable to be restored, due to a combination of factors including technical obsolescence, lack of vendor support, or the inability of the system to operate in a modern secure environment. (See Section Four, below.)",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d8ed8ce0b0be4611bb0a60e2a36de8ac2bfe40f6dd4b881b9316fb66d1f035a"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes system restoration or operational recovery work."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e5a25106-3ca4-516e-85d8-231cca71c16c",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:b4fd0745-2e2c-5306-8491-08133e7215ce",
      "confidence": 86,
      "external_references": [
        {
          "source_name": "British Library",
          "url": "https://www.bl.uk/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf/british-library-cyber-incident-review-8-march-2024.pdf?dl=",
          "external_id": "cit:00348548-6765-52c2-96aa-43f81a18d8c4",
          "description": "When it became clear that no ransom would be paid, this data was put up for auction and subsequently dumped on the dark web.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d8ed8ce0b0be4611bb0a60e2a36de8ac2bfe40f6dd4b881b9316fb66d1f035a"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Months-long systems outage; data auctioned on dark web."
      }
    }
  ]
}