{ "type": "bundle", "id": "bundle--685223eb-33ff-53a5-83a1-40ba255af19b", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--27d33394-b60b-531c-8e19-39f9bda09ad1", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "org:439a331c-8263-4010-9aff-cdbef3db038f", "name": "Bubble", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--1dc65f40-19e2-5d7c-85cb-e3f68439d65a", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "inc:60a148b8-710b-47db-a103-512e7f857620", "name": "Bubble platform and plugin credential incident" }, { "type": "incident", "spec_version": "2.1", "id": "incident--4e22e429-f074-525e-8dfe-cefd0da59d63", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "brh:b5c99664-eadc-4531-a03c-36cadaedb7f1", "name": "Bubble platform and plugin credential incident" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--38a1db10-b532-5769-81f2-cc4d189f311d", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:cddf5a0e-3920-49ed-a2ef-3bcc874aaaf9", "relationship_type": "resulted-in", "source_ref": "incident--1dc65f40-19e2-5d7c-85cb-e3f68439d65a", "target_ref": "x-ally-event--329576b6-701e-50eb-8817-8c2d74fb2908", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:c2353344-ce86-4573-880e-a056ac35fe48", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--48d22a12-9c47-5f10-89a9-0f4d4f105d99", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:c714e2b2-6231-4733-90ba-704c1c34405a", "relationship_type": "resulted-in", "source_ref": "incident--1dc65f40-19e2-5d7c-85cb-e3f68439d65a", "target_ref": "x-ally-event--228441e4-c393-5b60-8daf-6c3a6834ebc3", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:1518b297-1fdc-4033-8f84-a84bdd2c51cf", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8cb45499-273d-5430-8371-8d78c26a87de", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:7cef2274-d940-4473-a4b0-e3586b6ffb17", "relationship_type": "resulted-in", "source_ref": "incident--1dc65f40-19e2-5d7c-85cb-e3f68439d65a", "target_ref": "x-ally-event--7fb87b63-9e82-5f36-8428-4f115b380f28", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:50cbe979-8368-4b9e-8d54-09cc571fb8db", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b337fd8c-573e-5aaf-8052-8fac466b57de", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:f5e5cd1a-3aa2-4b37-b1c2-b76084faf906", "relationship_type": "affected-organization", "source_ref": "incident--1dc65f40-19e2-5d7c-85cb-e3f68439d65a", "target_ref": "identity--27d33394-b60b-531c-8e19-39f9bda09ad1", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:46130b3e-4a3d-4f32-8ec9-5252797f9f8e", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--352caadf-f084-5016-804b-1a0f368264e5", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:e28ef539-a88d-44aa-a60c-3e76619526d0", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:644a8af0-fab9-4e67-8b7a-d5a45a6b5cd0", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-26" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--450b03dd-9b7c-5f6d-88be-57f67df5ec82", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:83bca3ad-75ac-4556-b62d-07b7480fafb2", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:4963d406-79e7-4694-ad9e-8b1cd0f2c580", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-11-03" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--4b41cff8-92cd-5cf3-88f2-0e5976d369ae", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:068dea1e-1e67-4306-8b2a-dcde8c2ddd55", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:439b0cd9-fb88-4d00-a5aa-c36d8d1b3954", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The November 3 findings remained preliminary: independent scope review and detection of continuing attacks were ongoing." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--6d5dae89-3972-5115-8ba4-9debff592527", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:723bf307-64bd-4e08-b58d-55d110828689", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:94e4111c-9ea4-405e-999a-537b10d01cff", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Separate attacks on individual apps accessed data or credentials through platform issues or app settings. Bubble had not found that internal-system access was used to read app databases or user data." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--6e33fa5f-8715-5d79-84b1-096a017b6e0c", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:8398d8cd-656e-4bc6-b465-f97062024203", "confidence": 100, "external_references": [], "x_ally_claim_object": { "kind": "iri", "value": "https://attack.mitre.org/techniques/T1190/" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--9091d9a4-dbf0-5e8f-869d-77f7077ee79b", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:83b3ed63-416f-42ee-a722-7ab7d9b3234c", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:347e8447-f75d-4c9d-9b76-10aa98fc02a5", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-26" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--a28d1aaf-bbb6-59ef-87a5-3f44865d2ca9", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:105aa6ac-8736-4935-ab78-10b3741b858a", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:d6ad8f94-e649-49c4-96cc-68f81a68418c", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Temporary credentials provided access to further credentials. Previously obtained credentials were reused against an internal service on October 30–31." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--a399c391-9915-57aa-859a-f0a3205a6e82", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:593920be-b2b6-438a-b81f-47192e70aae8", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:335a9089-2ca5-4ea6-8659-b42bbf23befa", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-27" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--cfcc79d5-5766-5325-87f6-e6b61af3d61d", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:54f131b1-e38c-42a1-b646-331e32a6566f", "confidence": 100, "external_references": [], "x_ally_claim_object": { "kind": "iri", "value": "https://attack.mitre.org/techniques/T1078/" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--e7b62813-6617-5be8-8b0a-0747b89d0b65", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:f7925675-0548-4aa3-8688-731faac59774", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:ada63250-3592-4abe-97e9-0465adbeeae9", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Bubble detected unauthorized production-system access on October 26 after an application flaw exposed temporary credentials. The attacker reached internal systems and read private plugin credentials." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--f2637fe5-a2e7-5334-8fe0-01559689faf2", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:5450ef84-e5d1-4990-a541-f8d26e50d49a", "confidence": 100, "external_references": [ { "source_name": "Bubble", "url": "https://bubble.io/blog/october-2026-security-incident-rca/", "external_id": "cit:708d6a5b-666e-4c66-a673-d8ad70fa8c75", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:9f0cc30aae688c197fc6033f91b1516c72e4f4023a306cc7fba155512d75bef4" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Bubble patched the initial path, updated infrastructure, rotated credentials and contacted affected developers and app owners. Containment disrupted services, which were later restored." } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--228441e4-c393-5b60-8daf-6c3a6834ebc3", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "evt:8366ea1f-5ba2-41b9-9d9a-272c4314d51c", "name": "Preliminary findings published" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--329576b6-701e-50eb-8817-8c2d74fb2908", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "evt:617bb862-a4cd-45ac-a7dc-5615e687456d", "name": "Outside forensic firm engaged" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--7fb87b63-9e82-5f36-8428-4f115b380f28", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "evt:37f94cb9-9064-4015-8d9b-b595bd570c27", "name": "Production access detected; credentials rotated" } ] }