{
  "type": "bundle",
  "id": "bundle--40a13611-f031-562c-8923-00bec84f1789",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--aa9e7810-8645-5d6c-8393-71a33bd4fcca",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:844007e5-c5c4-5b33-bdaf-f2c8b4f7b3b3",
      "name": "Colonial Pipeline",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--7cbdaae6-ad06-5863-8115-a2f06042842e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:606f41c8-cf26-5e49-9bfb-9527c07bbda9",
      "name": "Colonial Pipeline security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--ef26ca62-9fc1-54fc-8806-6d70a7a039a3",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:f2450ad2-e9de-56f1-a275-9bd2e974859f",
      "name": "Colonial Pipeline security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a415ba33-ed66-5b1d-8091-b895ddc1afca",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:8e63788f-bc8e-5608-8523-941bdb5eb7f6",
      "relationship_type": "affected-organization",
      "source_ref": "incident--7cbdaae6-ad06-5863-8115-a2f06042842e",
      "target_ref": "identity--aa9e7810-8645-5d6c-8393-71a33bd4fcca",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "United States Department of Justice",
          "url": "https://www.justice.gov/archives/opa/speech/dag-monaco-delivers-remarks-press-conference-darkside-attack-colonial-pipeline",
          "external_id": "cit:c3196bcb-ad7e-5012-b67d-0e513097af2c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bdb21d6ad722ea89608294705690cbf45db6809e07c415878b17d1265d29846c"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2053d418-536c-56da-8888-9e28f2e4c96a",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:2dcd329c-d216-5ccb-b1b6-328f39a02831",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "United States Department of Justice",
          "url": "https://www.justice.gov/archives/opa/speech/dag-monaco-delivers-remarks-press-conference-darkside-attack-colonial-pipeline",
          "external_id": "cit:6930df92-cf96-5fc5-a4be-e2da8c7b02f6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:94370b1f42e7e2c3b04c5dee791cbdf6a7825353a80d82520000c281ec375df2"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "DarkSide carried out a ransomware attack against Colonial Pipeline."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3801a5e3-c5cd-5386-8997-3e7bfb117fc3",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:0b65b95a-5544-5477-9774-011e0e341a17",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "United States Department of Justice",
          "url": "https://www.justice.gov/archives/opa/speech/dag-monaco-delivers-remarks-press-conference-darkside-attack-colonial-pipeline",
          "external_id": "cit:c6845cdb-f9c3-592c-8a14-f1f7dc6bef9a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:94370b1f42e7e2c3b04c5dee791cbdf6a7825353a80d82520000c281ec375df2"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2021-06-07"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4b74d20b-af74-58fa-82c3-0d2bad64b074",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:64968274-a0d6-5692-883a-2aead5691ec5",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1486/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--665d0279-1585-5a02-8ce5-262cf801ec93",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:70c6453e-d888-5219-9b96-2420ba810ca7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "United States Department of Justice",
          "url": "https://www.justice.gov/archives/opa/speech/dag-monaco-delivers-remarks-press-conference-darkside-attack-colonial-pipeline",
          "external_id": "cit:3315908c-c487-56f3-b2b0-fb64616357f4",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bdb21d6ad722ea89608294705690cbf45db6809e07c415878b17d1265d29846c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the colonial pipeline security incident involving Colonial Pipeline."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--89e6ebcd-39b3-5ba1-84da-eba0cc27d709",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:b3291af5-3768-5748-97a8-bb7940a8103b",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "United States Department of Justice",
          "url": "https://www.justice.gov/archives/opa/speech/dag-monaco-delivers-remarks-press-conference-darkside-attack-colonial-pipeline",
          "external_id": "cit:fabee265-4c98-5bcc-a561-982fd83429b9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:94370b1f42e7e2c3b04c5dee791cbdf6a7825353a80d82520000c281ec375df2"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Colonial Pipeline paid a ransom, and the U.S. Department of Justice later recaptured the majority of that payment."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c5122979-a354-5eee-80d8-dad8344c73a7",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:56a84c74-2fa7-5cf2-acd8-5bbfb7493c61",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "United States Department of Justice",
          "url": "https://www.justice.gov/archives/opa/speech/dag-monaco-delivers-remarks-press-conference-darkside-attack-colonial-pipeline",
          "external_id": "cit:01515bf7-333f-5e5d-9b50-3fd9208be88e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:94370b1f42e7e2c3b04c5dee791cbdf6a7825353a80d82520000c281ec375df2"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Colonial Pipeline quickly notified law enforcement, enabling the FBI and Justice Department to trace and seize cryptocurrency ransom proceeds."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--d5ef99f3-5330-55b3-8381-8e04799a0830",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:e4d7ff26-414c-5f4f-b82d-9f0b27b9ebd3",
      "name": "Documented public update"
    }
  ]
}