{
  "type": "bundle",
  "id": "bundle--717cffcc-2c65-56a5-8c3f-e3463afad4e3",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--a0473019-594f-5af3-8f70-bfb08a2121bc",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "org:619e5ce4-e4cd-40a2-b5ff-8a0b7e928f24",
      "name": "Cushman & Wakefield plc",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--1205d1b8-daec-5d73-8a40-8347afeb6254",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "brh:4af86dfe-49e9-454e-8055-4172c03da649",
      "name": "Cushman & Wakefield vishing data breach"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--c7a82cd8-3690-56f4-8982-823c85a15cb4",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "inc:bd2a33c4-b8ff-4016-aa95-f3550b07e4e4",
      "name": "May 2026 Cushman & Wakefield vishing incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--05d1f5a1-d87e-5a0c-808a-d34cbfea68fb",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:78a0972e-186b-47fc-ab80-57cfa0c1e2a3",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--91004242-32d1-56db-8b98-d0a7479efa23",
      "target_ref": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CushmanWakefield",
          "external_id": "cit:57f650d1-4c6b-48b3-94bf-eb6ce07d93b1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d11e480d36c45fc410d5a7ab56fc4be5572c7a726277d5068786cd6ec8152442"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7980ed07-33f4-5526-87be-f8f489d2cc81",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:93ed3125-be4b-44cb-9c90-794ee128d381",
      "relationship_type": "resulted-in",
      "source_ref": "incident--c7a82cd8-3690-56f4-8982-823c85a15cb4",
      "target_ref": "x-ally-data-exposure--91004242-32d1-56db-8b98-d0a7479efa23",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CushmanWakefield",
          "external_id": "cit:25a6e1dc-135f-4dcf-ad66-e5fe32be03ba",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d11e480d36c45fc410d5a7ab56fc4be5572c7a726277d5068786cd6ec8152442"
        },
        {
          "source_name": "The Register",
          "url": "https://www.theregister.com/security/2026/05/05/cushman-wakefield-confirms-vishing-cyberattack/5228718",
          "external_id": "cit:185326e9-d48e-4366-9128-bcd1fc70785a",
          "x_ally_stance": "qualifies",
          "x_ally_snapshot_id": "snp:sha256:e506bf6798dc3d0130ac821ffb4ee58d48777dcf99f91cd70afcd546f5e786c7"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5012d6b-32b1-54ca-8ad7-e74d21802fe3",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:c28dada4-22bb-41dd-911c-bcd9e59c7f24",
      "relationship_type": "affected-organization",
      "source_ref": "incident--c7a82cd8-3690-56f4-8982-823c85a15cb4",
      "target_ref": "identity--a0473019-594f-5af3-8f70-bfb08a2121bc",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Register",
          "url": "https://www.theregister.com/security/2026/05/05/cushman-wakefield-confirms-vishing-cyberattack/5228718",
          "external_id": "cit:f807b065-aa8d-4bc5-8abe-df840eb7f304",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:e506bf6798dc3d0130ac821ffb4ee58d48777dcf99f91cd70afcd546f5e786c7"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ec695c5c-89f6-573c-82d4-6fe2b1ba1ca0",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:df68e522-1a93-4274-a375-689246b3f7a4",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--91004242-32d1-56db-8b98-d0a7479efa23",
      "target_ref": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CushmanWakefield",
          "external_id": "cit:bee9be41-8013-40e7-b441-b080b0a6eaea",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d11e480d36c45fc410d5a7ab56fc4be5572c7a726277d5068786cd6ec8152442"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee2aa65d-1dc4-5b3f-8331-0c7ecc62af06",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:ebe7bb51-9483-4cb9-a661-81eaa3e34138",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--91004242-32d1-56db-8b98-d0a7479efa23",
      "target_ref": "x-ally-data-category--772969d5-39f4-5aa9-8123-4f12a64d1594",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CushmanWakefield",
          "external_id": "cit:52f134a8-9747-4d39-a898-eade321ebfa3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d11e480d36c45fc410d5a7ab56fc4be5572c7a726277d5068786cd6ec8152442"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--25b44756-6705-5a12-8aa7-ce865632544d",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:41a84526-69a2-4aaf-ba43-7c7bce4fc566",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Register",
          "url": "https://www.theregister.com/security/2026/05/05/cushman-wakefield-confirms-vishing-cyberattack/5228718",
          "external_id": "cit:f71213f7-e5fd-41c2-bd86-e002f53af990",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:e506bf6798dc3d0130ac821ffb4ee58d48777dcf99f91cd70afcd546f5e786c7"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The company activated response protocols, took steps to contain unauthorized activity, and engaged third-party expert advisors."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4b74ec1b-6688-5af9-8439-43c1252cd5ed",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:ecdf0124-b2d2-4447-955f-7930dce65726",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CushmanWakefield",
          "external_id": "cit:fea7d86b-122d-4eaa-b829-b07208d55640",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d11e480d36c45fc410d5a7ab56fc4be5572c7a726277d5068786cd6ec8152442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "HIBP reported that associated data was published publicly after the incident."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--74cf86fd-2068-5a5a-8c46-f15dcf950a4c",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:897c9f31-3544-4a98-9f54-6856d8b45255",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Register",
          "url": "https://www.theregister.com/security/2026/05/05/cushman-wakefield-confirms-vishing-cyberattack/5228718",
          "external_id": "cit:5bbc8dfc-b546-4bd7-90e0-e80b57da28ae",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:e506bf6798dc3d0130ac821ffb4ee58d48777dcf99f91cd70afcd546f5e786c7"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-05-05"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7b09eed2-ba9e-5ad6-8745-0c224939b84a",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:dd808425-d8af-4b1e-ae4e-43a2d443a163",
      "confidence": 85,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CushmanWakefield",
          "external_id": "cit:6cbffe30-923d-48ee-81cb-8a559f1f47cb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d11e480d36c45fc410d5a7ab56fc4be5572c7a726277d5068786cd6ec8152442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-05-05"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--907d3507-f313-585b-8f1e-835f9f26b0a6",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:b182a0e4-8259-4595-b78a-668c565526fd",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Register",
          "url": "https://www.theregister.com/security/2026/05/05/cushman-wakefield-confirms-vishing-cyberattack/5228718",
          "external_id": "cit:ac514ce7-5a7b-493f-a018-9a7ff35afddd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:e506bf6798dc3d0130ac821ffb4ee58d48777dcf99f91cd70afcd546f5e786c7"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Cushman & Wakefield said its systems and operations continued to run normally while it investigated."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--aeef6042-6077-592c-84f4-fe0c44624365",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:ae3449a4-32d6-4a48-b608-ee8d603f6858",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/api/v3/breach/CushmanWakefield",
          "external_id": "cit:7268c551-34a8-4281-87d8-35fa40dee861",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d11e480d36c45fc410d5a7ab56fc4be5572c7a726277d5068786cd6ec8152442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "integer",
        "value": 310431,
        "unit": "record"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d9fa0b1d-4359-5018-8f94-f814a45a553a",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "clm:fdc8e711-35f2-4b48-bac5-a6b3eb6fba96",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Register",
          "url": "https://www.theregister.com/security/2026/05/05/cushman-wakefield-confirms-vishing-cyberattack/5228718",
          "external_id": "cit:e8a0cd51-d690-4f52-93a3-bd4c4bd940b1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:e506bf6798dc3d0130ac821ffb4ee58d48777dcf99f91cd70afcd546f5e786c7"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Cushman & Wakefield described the incident as limited in scope and caused by vishing."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e251cd70-77b6-52a5-8dca-a57f426cdb4f",
      "created": "2026-08-09T18:00:00Z",
      "modified": "2026-08-09T18:00:00Z",
      "x_ally_original_id": "clm:61d8c98e-4c1d-4a06-bb82-afb3623b3b02",
      "confidence": 95,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1566/004/"
      }
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--772969d5-39f4-5aa9-8123-4f12a64d1594",
      "created": "2026-08-09T04:16:47Z",
      "modified": "2026-08-09T04:16:47Z",
      "x_ally_original_id": "dat:68fb21c1-b8d3-41b3-acf6-93b7fd596c53",
      "name": "Employment information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:559cf3f5-80c7-45ba-a930-ff0bfa8d17b0",
      "name": "Names"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:5abcee7e-4a37-494a-b6ba-87ff46149be9",
      "name": "Contact information"
    },
    {
      "type": "x-ally-data-exposure",
      "spec_version": "2.1",
      "id": "x-ally-data-exposure--91004242-32d1-56db-8b98-d0a7479efa23",
      "created": "2026-08-09T06:51:22Z",
      "modified": "2026-08-09T06:51:22Z",
      "x_ally_original_id": "exp:a1fa7fe3-33f7-476e-9219-7b3e498a86a6",
      "name": "Cushman & Wakefield business-contact data corpus"
    }
  ]
}