{
  "type": "bundle",
  "id": "bundle--51ac95f1-553e-5e3f-862e-7e7034de898a",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--055d4832-c392-56d4-85e2-dcc584c52acf",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:b9f681ad-00f5-5dff-9e7e-da7d55dc9245",
      "name": "CNA Financial",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--723eb499-dc98-588f-847d-1851951faaab",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:b1878ee9-c391-5fe3-9417-a9fe5f0c8db6",
      "name": "CNA Financial security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--fb216090-4fe4-54f6-8f6c-5ebdda1d1b6d",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:8ed1cdc2-992e-5904-94cf-1a24ba4e11b6",
      "name": "CNA Financial security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c8f2e0b-d923-57e6-8787-7b03fd61c49e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:f681024a-1b19-5cdf-bddc-5f4a043ad6f0",
      "relationship_type": "affected-organization",
      "source_ref": "incident--fb216090-4fe4-54f6-8f6c-5ebdda1d1b6d",
      "target_ref": "identity--055d4832-c392-56d4-85e2-dcc584c52acf",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CNA Financial",
          "url": "https://www.cna.com/sites/default/files/assets/1077e9ef-e397-47f1-ad3c-27470e1b3fbc/July%2B9_Security%2BIncident%2BUpdate.pdf?fid=",
          "external_id": "cit:09c16db3-2892-5807-a638-9d86866dc3ee",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:433c5e04cfd33a7bc12ed125f2b723e629ead4ff7efcf003c8611114632b6fa1"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1e647ad9-0089-51ae-8116-1eaac275bf50",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:d2ae45ab-506c-52bb-ac66-ea7869eb474d",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "CNA Financial",
          "url": "https://www.cna.com/sites/default/files/assets/1077e9ef-e397-47f1-ad3c-27470e1b3fbc/July%2B9_Security%2BIncident%2BUpdate.pdf?fid=",
          "external_id": "cit:fe654461-fd13-57fd-971a-c313ca2c82aa",
          "description": "CNA immediately reported the incident to, and is working closely with, the appropriate law enforcement authorities, including the FBI.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:433c5e04cfd33a7bc12ed125f2b723e629ead4ff7efcf003c8611114632b6fa1"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source reports coordination with law enforcement as part of the incident response."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2f721685-9562-515f-8472-c57bd2cfa198",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:12ba363c-8b34-56d7-ab64-8362f68a4813",
      "confidence": 84,
      "external_references": [
        {
          "source_name": "CNA Financial",
          "url": "https://www.cna.com/sites/default/files/assets/1077e9ef-e397-47f1-ad3c-27470e1b3fbc/July%2B9_Security%2BIncident%2BUpdate.pdf?fid=",
          "external_id": "cit:a2e73c89-a4ce-5cf1-8546-7405211d1efc",
          "description": "The investigation revealed that the threat actor accessed certain CNA systems at various times from March 5, 2021 to March 21, 2021.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:433c5e04cfd33a7bc12ed125f2b723e629ead4ff7efcf003c8611114632b6fa1"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Major US insurer's own systems encrypted."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--411a6133-dbc4-5e7b-8962-2695b7596182",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:1a351923-ff41-54bc-a795-aa67326161fa",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "CNA Financial",
          "url": "https://www.cna.com/sites/default/files/assets/1077e9ef-e397-47f1-ad3c-27470e1b3fbc/July%2B9_Security%2BIncident%2BUpdate.pdf?fid=",
          "external_id": "cit:4302cbd1-9b79-512f-b2f2-813b47f16fb7",
          "description": "Once the incident was discovered, CNA immediately retained leading cybersecurity firms to assist in responding and help conduct a thorough investigation of the incident.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:433c5e04cfd33a7bc12ed125f2b723e629ead4ff7efcf003c8611114632b6fa1"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes a forensic or specialist investigation of the incident."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5d1c73fe-d572-5eb5-8935-0a88c8fbc97f",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:e818aa3a-9fff-5b86-8525-e9716d377437",
      "confidence": 83,
      "external_references": [
        {
          "source_name": "CNA Financial",
          "url": "https://www.cna.com/sites/default/files/assets/1077e9ef-e397-47f1-ad3c-27470e1b3fbc/July%2B9_Security%2BIncident%2BUpdate.pdf?fid=",
          "external_id": "cit:095bd22d-5ccd-5cfd-91e9-b834b06427e7",
          "description": "On July 9, CNA Financial Corporation (“CNA”) announced that it had concluded its forensic investigation into the March 2021 ransomware attack it sustained.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:433c5e04cfd33a7bc12ed125f2b723e629ead4ff7efcf003c8611114632b6fa1"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Phoenix Locker/Evil Corp; phishing/fake browser update."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ae872c51-db32-5556-861e-b1464457fbf9",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:8d11436f-69fe-5595-8384-4c6acf3eeefc",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CNA Financial",
          "url": "https://www.cna.com/sites/default/files/assets/1077e9ef-e397-47f1-ad3c-27470e1b3fbc/July%2B9_Security%2BIncident%2BUpdate.pdf?fid=",
          "external_id": "cit:ace2b001-74fb-5881-8eeb-5f2aaa0dfb05",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:433c5e04cfd33a7bc12ed125f2b723e629ead4ff7efcf003c8611114632b6fa1"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the cna financial security incident involving CNA Financial."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--bf77363e-b55a-59f2-84ce-fccdbc7c5e96",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:8ec5bcc5-e471-5673-8a53-be227339c432",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1566/"
      }
    }
  ]
}