{
  "type": "bundle",
  "id": "bundle--ee6d7d7c-415b-5ef2-83b1-7161258ace35",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--d4d104c1-67b6-5dea-8fc7-648030384d85",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "org:4c8f7758-b8ed-4bed-9c3e-c42e7336c55a",
      "name": "Cotton Incorporated",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--d8e060ef-a27a-5cb1-8500-f3984850165b",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "brh:7b7e30b4-e514-4892-880b-04fc856cc099",
      "name": "CottonWorks public-database exposure"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--f7a2422f-2d49-574a-87c9-177eb5a3758b",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "inc:29369309-c858-47ba-8315-1e9967acb69c",
      "name": "CottonWorks public-database exposure"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b1d3d5b-92b7-5fd6-8d6b-3fe15b4aca2c",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:7680bd69-b27b-4967-9962-6649416c365e",
      "relationship_type": "affected-organization",
      "source_ref": "incident--f7a2422f-2d49-574a-87c9-177eb5a3758b",
      "target_ref": "identity--d4d104c1-67b6-5dea-8fc7-648030384d85",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Cotton Incorporated",
          "url": "https://oag.ca.gov/system/files/Data%20Breach%20Notice_0.pdf",
          "external_id": "cit:604af49c-eb62-4754-9118-515ddf0c5750",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d2d940aaa7b139d0add5669126ee0605138ccd395d9ff05111cfb21f5e155e4"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--03a03d95-6c4c-573e-8f2b-a0658b624e91",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:c9d01306-a3df-456d-83ca-1ba6d51cdade",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Cotton Incorporated",
          "url": "https://oag.ca.gov/system/files/Data%20Breach%20Notice_0.pdf",
          "external_id": "cit:7d90211e-79a2-40ba-9bb0-e0db26962ccc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d2d940aaa7b139d0add5669126ee0605138ccd395d9ff05111cfb21f5e155e4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The company believed unknown parties downloaded the export four times between September 18 and October 15, 2026. It reported no evidence of subsequent use."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3c98de62-e48a-525d-8c93-e06ece8b670c",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:7114f9e1-b343-439d-8fb6-52f00c172386",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Cotton Incorporated",
          "url": "https://oag.ca.gov/system/files/Data%20Breach%20Notice_0.pdf",
          "external_id": "cit:bab0e76f-65d2-4a55-af37-13e70e22956e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d2d940aaa7b139d0add5669126ee0605138ccd395d9ff05111cfb21f5e155e4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The disclosure describes an accidentally public export, rather than establishing exploitation of a software vulnerability."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d468f5cf-9fca-5400-8bdd-7217f457923b",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:43aadd15-f0d9-4ca6-b3ec-2db54ea61d27",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Cotton Incorporated",
          "url": "https://oag.ca.gov/system/files/Data%20Breach%20Notice_0.pdf",
          "external_id": "cit:e8081995-fbd7-46e5-bddb-7555d750c736",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d2d940aaa7b139d0add5669126ee0605138ccd395d9ff05111cfb21f5e155e4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Cotton disabled access, removed cleartext passwords, required password changes and began reviewing security practices and hosting arrangements. It advised changing reused passwords elsewhere."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e419fc42-94d6-5ba8-8a20-c1fb01162443",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:5372843f-e595-4f07-b1e7-5b31a0024b05",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Cotton Incorporated",
          "url": "https://oag.ca.gov/system/files/Data%20Breach%20Notice_0.pdf",
          "external_id": "cit:4a739f53-8e3c-48db-a095-0705b4760bb0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d2d940aaa7b139d0add5669126ee0605138ccd395d9ff05111cfb21f5e155e4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The export could include names, emails, employer or school affiliation, addresses, user-supplied biographies and plaintext passwords."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--fcbc38f1-9054-585a-8c36-2a5b148ddb57",
      "created": "2026-11-04T14:19:50.607971+00:00",
      "modified": "2026-11-04T14:19:50.607971+00:00",
      "x_ally_original_id": "clm:21150e08-4850-473f-9c61-73721ae659f0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Cotton Incorporated",
          "url": "https://oag.ca.gov/system/files/Data%20Breach%20Notice_0.pdf",
          "external_id": "cit:33b62a2d-547d-459a-8a8d-6f8ec9b8adbc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2d2d940aaa7b139d0add5669126ee0605138ccd395d9ff05111cfb21f5e155e4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Cotton Incorporated said a CottonWorks.com database export was inadvertently made public during a hosting-provider migration."
      }
    }
  ]
}