{
  "type": "bundle",
  "id": "bundle--96e939f9-f3f8-5033-8aa1-bc1a8e122d01",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--4cae09d9-fb09-5eaa-85c7-cd51d3b6e3fd",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "org:ec69b362-3aa2-49a2-aa82-cba2b3ddecc3",
      "name": "Dorsata, Inc.",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--41f04d68-3186-5232-86a2-2a808bc98563",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "inc:c2889b7e-e296-498b-a306-ec0f172b417c",
      "name": "Dorsata Metabase patient-data incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--7d6d2c1d-ed40-5180-85ea-3ad78c9a20b4",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "brh:4fe19225-83c7-4279-8b85-beca6048f478",
      "name": "Dorsata Metabase patient-data incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--02224d33-4479-5448-8372-36f0caa3bf47",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:076cdcec-3d83-439e-9128-8d8b7fb883ea",
      "relationship_type": "resulted-in",
      "source_ref": "incident--41f04d68-3186-5232-86a2-2a808bc98563",
      "target_ref": "x-ally-event--18ce5806-22f2-5d9e-8f7c-6b26443d2d7c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://oag.ca.gov/system/files/Regulatory%20Notice%20Letter_Dorsata_CA_0.pdf",
          "external_id": "cit:f4520dec-4300-4169-a09d-d3050c7a5156",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c10ebb07da5115850cfcedc4704c1b1f2d94135637f91e261f4bd7f0515c22e8"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--119e605d-9a5b-5347-836e-21e14be14636",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:55929cc2-94a8-4864-a200-9ef4c877ed65",
      "relationship_type": "affected-organization",
      "source_ref": "incident--41f04d68-3186-5232-86a2-2a808bc98563",
      "target_ref": "identity--4cae09d9-fb09-5eaa-85c7-cd51d3b6e3fd",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:2ea59329-50a6-4b9d-97b0-9272e697f909",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1c4b661c-6a09-513f-837a-bf92792e6c56",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:8d6ad262-11d3-45ca-884a-ba949aacbc62",
      "relationship_type": "used-product",
      "source_ref": "incident--41f04d68-3186-5232-86a2-2a808bc98563",
      "target_ref": "software--f5aaa094-f5d4-5cf0-8c66-18bf59f84ff7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:e60d0fbd-0ad2-4a4e-9368-986167c0411b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9fd0a0a0-4df5-55a5-83d8-e1a1858ba31f",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:afd4f092-a7ca-44eb-8ea8-7face869bb69",
      "relationship_type": "resulted-in",
      "source_ref": "incident--41f04d68-3186-5232-86a2-2a808bc98563",
      "target_ref": "x-ally-event--11dfe014-9092-54de-8332-0051e8866b1e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:675e0d29-c600-4ad9-9ec7-f16d35beeecc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f5aaa094-f5d4-5cf0-8c66-18bf59f84ff7",
      "created": "2026-10-07T09:27:34Z",
      "modified": "2026-10-07T09:27:34Z",
      "x_ally_original_id": "prd:696e4661-bed7-4d3f-b5a6-9e2e31ab15a1",
      "name": "Metabase"
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3f057971-7366-54ad-862c-a19f1098730a",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:f44be7a5-27a9-4f17-9e60-8b192b3a1606",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:0de624b3-7e11-40ce-8871-751fc3741638",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-08-10"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--54d7c2c2-a51d-52d0-8614-2037b0382e4a",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:e197dcd5-daef-4327-b82e-f89d32583209",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:337cc035-b29f-4fa0-b1ab-651760087f1d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Potentially involved data included names, addresses, patient IDs, dates of birth, vital signs, treatment information and location, provider names, vaccines, medications, insurance details and medical histories."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7ed5203a-66e7-5991-8e02-b99a8d92416a",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:9bc3f147-4d42-411d-ad24-a5f68892998f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:7f8e7c0e-e01d-4666-8fb5-c1bc31c8c25b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--818be1f4-cc71-5d58-814f-7b6f3364182d",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:41d79905-26e5-4ae0-ac29-31ef135de004",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://oag.ca.gov/system/files/Regulatory%20Notice%20Letter_Dorsata_CA_0.pdf",
          "external_id": "cit:44fb2e11-5a51-482f-b062-92f995c6f057",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c10ebb07da5115850cfcedc4704c1b1f2d94135637f91e261f4bd7f0515c22e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Dorsata patched the software immediately after receiving a vulnerability notice on or about August 12, investigated with independent experts and sent notices on behalf of healthcare-provider partners."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8f8bde27-7246-543a-89ec-cdaa6da02001",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:a3d6c560-3dc1-4aee-b53e-61b30294f606",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:609bad31-e137-4922-a98d-54ffc78cf3b3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Dorsata said a Metabase vulnerability allowed unauthorized access to its patient database from August 10 through August 12, 2026."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b2d8b87d-8d45-5557-88d8-d456cc92d48d",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:0a1e1807-eae9-483f-bb3d-eda8b141492c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:3cebcc10-6c2d-4277-9f29-94084dcb6757",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c7ab7999-f59a-5acb-81d8-55c95ed70b89",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:f8f4a7c9-ec4e-4754-86f9-123f6fc409f3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:702d9066-2c4c-4222-9a2c-8a004c971c2f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-08-12"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cfeb6a99-8fe1-5675-82e4-e9fcb8fe15c9",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:e4e8897c-a0f1-4e22-9a84-6d2021f4bc8d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://dorsata.com/2026-metabase-security-incident/",
          "external_id": "cit:1a89172d-f45d-4a4c-9bac-c28c867b375e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:bc414fae76fa9525973d8de6ebfd0763b15eb2a54792839eed11d1f08ee21442"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Dorsata said Social Security numbers, driver’s-license numbers and financial information were not involved; it had no evidence of misuse or attempted misuse."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--edff3e39-c184-5331-8531-5426cc1c337b",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "clm:77de9b21-1a91-4910-a67d-8d92e16fa7ec",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dorsata",
          "url": "https://oag.ca.gov/system/files/Regulatory%20Notice%20Letter_Dorsata_CA_0.pdf",
          "external_id": "cit:843c7666-8e84-443c-99bc-3f171e6606fc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c10ebb07da5115850cfcedc4704c1b1f2d94135637f91e261f4bd7f0515c22e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-08-12"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--11dfe014-9092-54de-8332-0051e8866b1e",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "evt:5d82bb08-1432-4e67-bc84-d07c686447af",
      "name": "Public patient notice published"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--18ce5806-22f2-5d9e-8f7c-6b26443d2d7c",
      "created": "2026-10-23T14:20:19.933848+00:00",
      "modified": "2026-10-23T14:20:19.933848+00:00",
      "x_ally_original_id": "evt:7c232629-509e-4116-90f3-7413374e07b2",
      "name": "Vulnerability notice prompted patching and investigation"
    }
  ]
}