{
  "type": "bundle",
  "id": "bundle--d680d0c3-8ab0-5601-8202-5d95c77cf16f",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--1bb62c00-9d27-5165-8c87-60fe3c3c2502",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "org:d91e386c-af26-47e6-96b8-ac747c9796ad",
      "name": "CarGurus, Inc.",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--483f7667-5a6b-52f3-8281-61df0af57926",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "brh:519c1dfb-d2d3-4557-93c4-728e1592a81b",
      "name": "CarGurus internal-database cybersecurity incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--bf5eef89-2d7a-57e2-8ac8-2ac252d9230e",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "inc:de1db8ba-21d5-40f6-9c10-0053b7533e26",
      "name": "February 2026 CarGurus cybersecurity incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b4bda86-b75b-5438-8e02-d9f86a220090",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:46445575-c29c-4c10-9071-f13f30782706",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--f359f45c-e04e-53d0-82bc-50c3350ae981",
      "target_ref": "x-ally-data-category--72153833-bd67-543e-8613-f0948694cf4a",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CarGurus",
          "external_id": "cit:d1fb3a86-2c02-4aba-81f3-f306dd087b22",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2ca9fee81100dec115e7f5b8faa8aef1d948058d09d16f60d74133e33f99ef"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--979a1226-74c5-5320-8c59-1ccbc83f3419",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:3e6e7741-578c-4076-8ae3-d48a0cab2699",
      "relationship_type": "affected-organization",
      "source_ref": "incident--bf5eef89-2d7a-57e2-8ac8-2ac252d9230e",
      "target_ref": "identity--1bb62c00-9d27-5165-8c87-60fe3c3c2502",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:44cfb75a-3536-4ec6-857f-94605ed427dd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c89e7f3c-fe6b-59fd-82f8-80d0ece6f703",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:1384a8b3-0511-4b48-9a71-53453c4dd780",
      "relationship_type": "resulted-in",
      "source_ref": "incident--bf5eef89-2d7a-57e2-8ac8-2ac252d9230e",
      "target_ref": "x-ally-notification--7fc957d4-65ea-5a87-8828-e3ea133253be",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:0a03f249-175a-4156-ba02-a3c429dbbd9d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb57549c-eb69-50a5-80fc-31562b79baf0",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:9af7165a-2a44-4235-8a28-c96fc7b864d1",
      "relationship_type": "resulted-in",
      "source_ref": "incident--bf5eef89-2d7a-57e2-8ac8-2ac252d9230e",
      "target_ref": "x-ally-data-exposure--f359f45c-e04e-53d0-82bc-50c3350ae981",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CarGurus",
          "external_id": "cit:c4357c2c-1e99-4e5c-a495-58efd4c9fbfb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2ca9fee81100dec115e7f5b8faa8aef1d948058d09d16f60d74133e33f99ef"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3db3438-82e7-5a4d-8c76-9c79766388ce",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:f639e8a6-b542-4a96-aee5-9efaa23d1024",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--f359f45c-e04e-53d0-82bc-50c3350ae981",
      "target_ref": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CarGurus",
          "external_id": "cit:60937cd5-f280-4a14-a0d8-c3aaa11f5495",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2ca9fee81100dec115e7f5b8faa8aef1d948058d09d16f60d74133e33f99ef"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da7ab1e2-1f4b-531f-8da7-979e95e6b048",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:b86a6c72-7520-4c09-93ca-bc5d08261c3c",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--f359f45c-e04e-53d0-82bc-50c3350ae981",
      "target_ref": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CarGurus",
          "external_id": "cit:02669830-4cec-45dc-b314-6d19f2ab460c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2ca9fee81100dec115e7f5b8faa8aef1d948058d09d16f60d74133e33f99ef"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--02676091-a89b-5d8b-808b-e9dff25ff022",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:a7ff3d7d-2d0a-41e9-92ec-b9067539a214",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:25dbb6de-f1c8-4300-890b-c353aeaba3ef",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus said the incident impacted limited sensitive data."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0c5c8ec6-8c04-5221-8fb9-23f13ce2cc26",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:4310372e-bd42-4c61-a0e8-3b48b7be666e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:c8a5a526-c946-4809-ba41-03dde6328e56",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus said dealer passwords were not compromised and that it had no evidence user accounts were at risk."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1741ea33-6291-54af-853a-a32efd47a311",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:88b3b191-7e4c-4f9b-9aef-f53d5a3cde57",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CarGurus",
          "external_id": "cit:6e4de6bf-7cfe-4b7d-9957-c969e0140664",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2ca9fee81100dec115e7f5b8faa8aef1d948058d09d16f60d74133e33f99ef"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "HIBP described multiple files containing user-account ID mappings, finance pre-qualification application data, and dealer account and subscription information."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2521be72-b5af-59b9-87b3-9ab494d10a6a",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:6b724d36-5bff-45bc-989e-cec99eca744e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:81d74869-8c4d-44ff-94b1-33f06789c8b2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus said the limited event involved an internal company database that was promptly secured."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2596b708-caac-55f2-8168-2c68303d80d9",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:5262797d-14e2-43fb-b8e6-28f494d58f78",
      "confidence": 80,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CarGurus",
          "external_id": "cit:7c62b834-f504-48d5-9c62-b6e0f354e22f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2ca9fee81100dec115e7f5b8faa8aef1d948058d09d16f60d74133e33f99ef"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-02-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--28b2de31-04bb-5c61-8765-b262576b69f3",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:857a1547-daf1-4352-ac22-01ff3779bc0c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:83b13bc3-7f3e-4b9e-93b0-b863dda360b2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus completed its investigation with assistance from an independent cybersecurity firm, whose findings it said were consistent with its internal assessment."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--498fce57-ed2c-5c83-8cea-7985130922bd",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:071fcd61-d9e0-4a13-a6c2-1cf10a3df201",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:453d5dc1-f711-43f7-b65f-08815a7ae43e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-02-22"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4a6aceca-777f-55f6-8c1e-80d66b293a04",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:11412a3b-03db-485b-8f79-aa6604a88ea5",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:d0399a92-d8bb-4c40-9c82-b013bd7d9aea",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus emailed all primary dealership contacts and published a dealer-facing update on February 22, then continued direct communications as its investigation progressed."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--547fa7a6-eb62-544e-80cc-ed1455c17089",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:f1795e3d-07b1-4275-95e7-ed17839b5651",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CarGurus",
          "external_id": "cit:c73e3135-c349-45f8-b4a7-a679bfac2213",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2ca9fee81100dec115e7f5b8faa8aef1d948058d09d16f60d74133e33f99ef"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "integer",
        "value": 12461887,
        "unit": "record"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5a7aa3a9-e73c-5785-8a34-49a1dae2c574",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:824d26cc-e9dc-4fff-9f20-d1fba448d9e3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:8016d10b-95cc-47f4-ab00-f62a029cc9aa",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus said dealer data feeds, APIs, dealer CRMs, and core systems or products used by dealer partners or consumers were not compromised."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--71b19a22-3fb7-5ff9-8887-10eb475994b0",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:02fbe7fa-7de1-4f9f-a018-b0a6bde1f640",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:b2ec86e8-9789-4dc2-b9f3-b69a3bef594a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus said dealer data mainly included publicly available dealer names and contact details."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7e0e6888-0bcb-5dc0-8d63-c0148975a362",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:da12e650-85fa-4c37-b16d-0b315fe02382",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:682cf841-a353-437e-a0a6-201a61c43172",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus said it directly contacted dealer partners in the rare cases where sensitive dealership information might have been involved."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8ce060b1-e535-5e95-86f8-69b96421df94",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:ca9db23a-d4c4-4235-8a94-a87e759da377",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:bbfe7d10-c315-42cc-ad81-ca3edb3020c1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus said the incident was limited in scope and contained."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f325bc48-d500-534d-8a49-80e9614e01f2",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "clm:bc7e612e-6fdf-4515-983b-b84d84a7f54c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CarGurus, Inc.",
          "url": "https://dealers.cargurus.com/blog/cybersecurity-incident-information",
          "external_id": "cit:32d7be18-01c6-4913-bb81-b566ad73dfec",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:4075c312a3de5c2acd4f6b8bc0f859716b751a6d8194855132433c8000493707"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "CarGurus remained fully operational and reported no interruption to its services."
      }
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--72153833-bd67-543e-8613-f0948694cf4a",
      "created": "2026-08-09T04:22:59Z",
      "modified": "2026-08-09T04:22:59Z",
      "x_ally_original_id": "dat:5fa04562-6078-4a17-ae1b-d0583129fd47",
      "name": "IP addresses"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:559cf3f5-80c7-45ba-a930-ff0bfa8d17b0",
      "name": "Names"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:5abcee7e-4a37-494a-b6ba-87ff46149be9",
      "name": "Contact information"
    },
    {
      "type": "x-ally-data-exposure",
      "spec_version": "2.1",
      "id": "x-ally-data-exposure--f359f45c-e04e-53d0-82bc-50c3350ae981",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "exp:a28013f8-1fb9-4a7d-86f8-f60d8ee5678f",
      "name": "CarGurus customer and dealer data corpus"
    },
    {
      "type": "x-ally-notification",
      "spec_version": "2.1",
      "id": "x-ally-notification--7fc957d4-65ea-5a87-8828-e3ea133253be",
      "created": "2026-08-09T06:28:47Z",
      "modified": "2026-08-09T06:28:47Z",
      "x_ally_original_id": "ntf:9affd203-cb7b-44d2-8423-d379976e38c6",
      "name": "CarGurus dealer incident communications"
    }
  ]
}