{
  "type": "bundle",
  "id": "bundle--94a17d53-fec9-5c61-8ff2-c3a921a521a9",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--32b90976-fc49-5f03-8bbc-4721d49e42e2",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:7e359009-fb24-5dfe-b94e-ea40163f2342",
      "name": "Change Healthcare",
      "identity_class": "organization"
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--4d27de5d-963e-58b6-80c2-f7e11096ea6a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:4f31a9bb-e4ff-5c21-a922-6a17047ce312",
      "name": "UnitedHealth Group",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--8cf1b992-cb06-578c-8180-6e390b615845",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:71df3e74-1a3e-5ae0-97d9-84f98e7dcba3",
      "name": "Change Healthcare / UnitedHealth Group security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--93bc2b35-933c-57d8-888d-a3388860580f",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:8893c620-80db-529f-8b6d-8a12e93961f1",
      "name": "Change Healthcare / UnitedHealth Group security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24a60dfb-c333-57f0-846f-cc8c3cbacb1f",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:2b3a1742-db03-59b5-a422-8e482aba69f9",
      "relationship_type": "attributed-to",
      "source_ref": "incident--8cf1b992-cb06-578c-8180-6e390b615845",
      "target_ref": "x-ally-threat-actor--aeb8eab9-37d8-5016-8e9a-52f2e2647376",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. House Committee on Energy and Commerce",
          "url": "https://docs.house.gov/meetings/IF/IF02/20240501/117242/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf",
          "external_id": "cit:2b3a1742-db03-59b5-a422-8e482aba69f9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8e672e9f572a6b1dfe2559c452675c9719092f2497a01c7c9cc03e3a9f526e3b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7dd0a646-2d0d-5e8b-8562-a818e206b803",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:a2201a32-93fe-53cd-b919-41a8cf18a428",
      "relationship_type": "affected-organization",
      "source_ref": "incident--8cf1b992-cb06-578c-8180-6e390b615845",
      "target_ref": "identity--4d27de5d-963e-58b6-80c2-f7e11096ea6a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html",
          "external_id": "cit:18e91b31-30e8-5e34-b34c-8c1008019d3a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0b128353f59d8714b04cf333470ee81aa3264fa630e0b741174e2943f9d69ee8"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff967d77-07df-566e-8ecd-1d8d322bacee",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:86eb757b-7e58-5973-8cfd-7948ce9678be",
      "relationship_type": "affected-organization",
      "source_ref": "incident--8cf1b992-cb06-578c-8180-6e390b615845",
      "target_ref": "identity--32b90976-fc49-5f03-8bbc-4721d49e42e2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html",
          "external_id": "cit:d8cc6383-e499-55ff-a07d-70da90d6e679",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0b128353f59d8714b04cf333470ee81aa3264fa630e0b741174e2943f9d69ee8"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--09be1c87-ffa3-5ebe-8087-e51f45939b13",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:f13b03ce-aacb-5f0a-8eb8-8bb61711a9fb",
      "confidence": 95,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1078/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--31c48cac-1034-576f-83b9-dd5736734bbe",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:84ae47bc-4cf0-5ac7-865d-fd7cb965d883",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/content/dam/UHG/PDF/investors/2024/2025-16-01-uhg-reports-fourth-quarter-results.pdf",
          "external_id": "cit:84ae47bc-4cf0-5ac7-865d-fd7cb965d883",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7dd627fa84e57a280941adc542bd2845513d38926495ac85f2236fae8879ff6a"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2025-01-16"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--36c1078b-5d04-589d-88ca-8520a274ae1e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:632a18a9-577f-5932-bd9a-dc219200ef18",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html",
          "external_id": "cit:62250ee5-03dd-5fa0-8f99-ea009526bc66",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0b128353f59d8714b04cf333470ee81aa3264fa630e0b741174e2943f9d69ee8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the change healthcare / unitedhealth group security incident involving Change Healthcare, UnitedHealth Group."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--388ba8f3-994d-5620-87bd-a7bc99af56d1",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:35abaf60-4d50-5d56-b545-57c6ac4c32f2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. House Committee on Energy and Commerce",
          "url": "https://docs.house.gov/meetings/IF/IF02/20240501/117242/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf",
          "external_id": "cit:35abaf60-4d50-5d56-b545-57c6ac4c32f2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8e672e9f572a6b1dfe2559c452675c9719092f2497a01c7c9cc03e3a9f526e3b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2024-02-12"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--431ed13b-13e8-5e27-8c09-e1fbe1890dc9",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:98c7266c-6146-5028-b27a-b49a6a7589ef",
      "confidence": 95,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1133/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--574e7f3b-5262-5371-8272-d17ab0121fcc",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:8997f7cc-8a21-5e06-9c51-d6b661dcbbe5",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html",
          "external_id": "cit:8997f7cc-8a21-5e06-9c51-d6b661dcbbe5",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0b128353f59d8714b04cf333470ee81aa3264fa630e0b741174e2943f9d69ee8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2024-04-22"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5d97706c-857b-55a5-8dbd-a2850d82d8ee",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:b57d49a5-bdc8-57fc-a1ff-8169032aa459",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. House Committee on Energy and Commerce",
          "url": "https://docs.house.gov/meetings/IF/IF02/20240501/117242/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf",
          "external_id": "cit:b57d49a5-bdc8-57fc-a1ff-8169032aa459",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8e672e9f572a6b1dfe2559c452675c9719092f2497a01c7c9cc03e3a9f526e3b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2024-02-12"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--75a30547-5fb0-5a1a-8074-03d53b0498d8",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:d33461ca-2ec5-523f-85b1-e4de53467cea",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html",
          "external_id": "cit:d33461ca-2ec5-523f-85b1-e4de53467cea",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0b128353f59d8714b04cf333470ee81aa3264fa630e0b741174e2943f9d69ee8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "By April 22, UnitedHealth reported that 99% of pre-incident pharmacies could process claims, medical claims were flowing at near-normal levels, payment processing was at about 86% of pre-incident levels, and roughly 80% of major-platform functionality had been restored."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--76fb61ee-ff86-5cf3-89b4-90afb7890c90",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:d4ea7fce-9e04-51a7-9bc5-4a8ed74bf64d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. House Committee on Energy and Commerce",
          "url": "https://docs.house.gov/meetings/IF/IF02/20240501/117242/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf",
          "external_id": "cit:d4ea7fce-9e04-51a7-9bc5-4a8ed74bf64d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8e672e9f572a6b1dfe2559c452675c9719092f2497a01c7c9cc03e3a9f526e3b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2024-02-21"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--81a49cbe-52e5-5abe-86d6-287b187d4443",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:1419514f-1f25-5aa1-95d7-33e057bb6f7e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-03-07-uhg-update-change-healthcare-cyberattack.html",
          "external_id": "cit:1419514f-1f25-5aa1-95d7-33e057bb6f7e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6c74203a585044b141e655381da2e982d3670f6e122df58f3e2b0bcc44c7d22e"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2024-03-07"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--938a5744-f48d-514e-8fea-08a37e457634",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:199ff565-6552-5d23-8254-1f174a54b433",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/content/dam/UHG/PDF/investors/2024/2025-16-01-uhg-reports-fourth-quarter-results.pdf",
          "external_id": "cit:199ff565-6552-5d23-8254-1f174a54b433",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7dd627fa84e57a280941adc542bd2845513d38926495ac85f2236fae8879ff6a"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "For 2024, UnitedHealth reported $2.223 billion in direct cyberattack response costs and $867 million in reduced revenue from business disruption, for $3.090 billion in total pre-tax cyberattack impacts."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a303e43c-f191-5d15-8de5-904ef1747cc3",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:3c25412b-b4f3-55eb-b70b-546c59ff3fca",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html",
          "external_id": "cit:3c25412b-b4f3-55eb-b70b-546c59ff3fca",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0b128353f59d8714b04cf333470ee81aa3264fa630e0b741174e2943f9d69ee8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "UnitedHealth's preliminary targeted sampling found files containing protected health information or personally identifiable information that could cover a substantial proportion of people in the United States."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a973f3af-2631-5795-8cf7-39f273efdb75",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:5e901bf9-43b0-5c7e-9965-e2508a9dd4c2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. House Committee on Energy and Commerce",
          "url": "https://docs.house.gov/meetings/IF/IF02/20240501/117242/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf",
          "external_id": "cit:5e901bf9-43b0-5c7e-9965-e2508a9dd4c2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8e672e9f572a6b1dfe2559c452675c9719092f2497a01c7c9cc03e3a9f526e3b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Criminals used compromised credentials to access a Change Healthcare Citrix remote-access portal that did not have multi-factor authentication, then moved laterally and exfiltrated data."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c7b6da68-cd44-50df-8c54-d864710f576d",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:cfe1f1dc-06ed-5da9-9b3c-985087be864a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html",
          "external_id": "cit:cfe1f1dc-06ed-5da9-9b3c-985087be864a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0b128353f59d8714b04cf333470ee81aa3264fa630e0b741174e2943f9d69ee8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "UnitedHealth established a call center and offered two years of credit monitoring and identity-theft protection to affected people while the data review continued."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--de5208c7-06e6-52a7-835a-b28f8af8d2db",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:6bb539f6-facf-56f7-8f2c-729c43edb594",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-03-07-uhg-update-change-healthcare-cyberattack.html",
          "external_id": "cit:6bb539f6-facf-56f7-8f2c-729c43edb594",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6c74203a585044b141e655381da2e982d3670f6e122df58f3e2b0bcc44c7d22e"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The attack disrupted pharmacy, medical-claims, and payment systems across the U.S. health system, forcing providers and pharmacists to use workarounds and creating cash-flow pressure for care providers."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e0a5402a-2fcb-5b9a-89f8-66371ea45dbd",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:764526fd-01f0-5d19-8978-a7b0f8ee82c7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. House Committee on Energy and Commerce",
          "url": "https://docs.house.gov/meetings/IF/IF02/20240501/117242/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf",
          "external_id": "cit:764526fd-01f0-5d19-8978-a7b0f8ee82c7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8e672e9f572a6b1dfe2559c452675c9719092f2497a01c7c9cc03e3a9f526e3b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "UnitedHealth contacted the FBI within hours of the ransomware deployment and continued sharing intrusion details with law enforcement."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ec4e2a2a-4f5c-5cbb-83ec-02b4070c043e",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:edb3dbd6-8eb8-5186-b27b-30a71db4c345",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-03-07-uhg-update-change-healthcare-cyberattack.html",
          "external_id": "cit:edb3dbd6-8eb8-5186-b27b-30a71db4c345",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:6c74203a585044b141e655381da2e982d3670f6e122df58f3e2b0bcc44c7d22e"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "UnitedHealth created temporary, interest-free funding programs to help providers bridge cash-flow gaps while claims and payment services were disrupted."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ee974826-ed43-5b79-8796-3f170cddc9ed",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:63eb642f-5458-5309-9d7a-56c17a941e2d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UnitedHealth Group",
          "url": "https://www.unitedhealthgroup.com/newsroom/2024/2024-04-22-uhg-updates-on-change-healthcare-cyberattack.html",
          "external_id": "cit:63eb642f-5458-5309-9d7a-56c17a941e2d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0b128353f59d8714b04cf333470ee81aa3264fa630e0b741174e2943f9d69ee8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "UnitedHealth reported that 22 screenshots allegedly taken from exfiltrated files, some containing PHI and PII, were posted on the dark web for about one week."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f0d9b770-0cf5-5802-88f3-add4a0a2e7b7",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:f1151740-2633-5873-b364-76b3d486b1fc",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. House Committee on Energy and Commerce",
          "url": "https://docs.house.gov/meetings/IF/IF02/20240501/117242/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf",
          "external_id": "cit:f1151740-2633-5873-b364-76b3d486b1fc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8e672e9f572a6b1dfe2559c452675c9719092f2497a01c7c9cc03e3a9f526e3b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "UnitedHealth Group CEO Andrew Witty testified that he made the decision to pay a ransom; the testimony did not state the amount."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f58c4022-eb0f-54e5-8ade-c844ad6bbace",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:0482b929-6b01-5647-8594-dcb392b7a703",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. House Committee on Energy and Commerce",
          "url": "https://docs.house.gov/meetings/IF/IF02/20240501/117242/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf",
          "external_id": "cit:0482b929-6b01-5647-8594-dcb392b7a703",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8e672e9f572a6b1dfe2559c452675c9719092f2497a01c7c9cc03e3a9f526e3b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "ALPHV/BlackCat deployed ransomware on February 21, 2024, encrypting Change Healthcare systems and prompting the company to disconnect affected systems to contain the attack."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--0b66603c-574b-58ea-82cf-b2c0a272441e",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:d33461ca-2ec5-523f-85b1-e4de53467cea",
      "name": "Restoration update"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--119b4614-a040-50d5-8bff-100aab363678",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:4ad28262-bffe-51bc-901c-b296dc52cd22",
      "name": "Data and restoration update"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--1ebfd1c4-4f5e-581a-8b27-85d426360631",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:7d8b8df7-1228-5003-bac1-bd66c5b1c413",
      "name": "Initial access"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--58d74b9e-a949-5540-89b7-c9f2b777b82f",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:e4129573-d01e-5f53-a075-20fa0ff88035",
      "name": "Full-year financial impact reported"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--b2671854-345c-5f03-85f3-c324ba6b61b4",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:b4a50408-53d5-58c1-a4a1-7ceeb9672e91",
      "name": "Ransomware deployment and containment"
    },
    {
      "type": "x-ally-threat-actor",
      "spec_version": "2.1",
      "id": "x-ally-threat-actor--aeb8eab9-37d8-5016-8e9a-52f2e2647376",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "act:a464d954-d253-56ae-a8e3-5d2f6a490b8c",
      "name": "ALPHV/BlackCat"
    }
  ]
}