{
  "type": "bundle",
  "id": "bundle--1aa4a9f9-87e1-582b-8cf6-dda6000c3bfb",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--495bbc5c-3760-5b3c-8484-25df2635cad5",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:bd93ed07-fd34-5500-9563-9c486fa6980a",
      "name": "Dropbox",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--1c739de5-751f-5807-840e-a6e660ecb19a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:377b71fa-206a-599d-9bd3-9c444b7cb616",
      "name": "Dropbox security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--fb757fad-0c45-5e5b-8cf7-8905cc8d9de8",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:d7a18ac2-1ef7-5fda-b0ed-63c8133a9f16",
      "name": "Dropbox security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8f8e09e8-fe05-516a-8c47-117d2cfae6bc",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:d0c843e4-0005-5d25-baee-1ecc7f586378",
      "relationship_type": "affected-organization",
      "source_ref": "incident--fb757fad-0c45-5e5b-8cf7-8905cc8d9de8",
      "target_ref": "identity--495bbc5c-3760-5b3c-8484-25df2635cad5",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dropbox",
          "url": "https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign",
          "external_id": "cit:a361d5c3-19b4-5427-9021-387a37e64755",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:ff362c90ab0bd8cc39460952f94c533ecdc0ac95dfef8c41f05025008a618537"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7a724049-ea9c-5b77-8210-108129104234",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:7dc3562f-fa08-54c0-bef4-2d8279806f45",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Dropbox",
          "url": "https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign",
          "external_id": "cit:0f0c8250-81c2-5c23-977f-039b8faa5ff3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:ff362c90ab0bd8cc39460952f94c533ecdc0ac95dfef8c41f05025008a618537"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the dropbox security incident involving Dropbox."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--81e39660-34bd-535c-8e46-04855f235942",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:65a84f0c-a525-5760-ae58-1aa5933f6a36",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1566/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9bd37ab1-fa06-5575-8985-7a6f00dc4097",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:ce30789d-cb3f-5eb1-afe0-aff82ab24167",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1528/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--bf62909d-40a3-572f-82a6-ad021998bad9",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:01c63258-9b47-5ce7-aa4f-cfe89ffbe009",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Dropbox",
          "url": "https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign",
          "external_id": "cit:fa17b9bd-6ab1-5338-9fa0-1adc6ff0611a",
          "description": "We believe that this incident was isolated to Dropbox Sign infrastructure, and did not impact any other Dropbox products.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f779aae98dfe32ac3846a23c71516f0bd341ec061b48eea835906e1b57cda2db"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes containment action intended to limit further access or disruption."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f2288010-ce2f-5c31-821c-86475d2dbe1a",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:f14b7558-71b6-5cfd-a657-9d887a871acf",
      "confidence": 84,
      "external_references": [
        {
          "source_name": "Dropbox",
          "url": "https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign",
          "external_id": "cit:17d4150e-1e9a-506e-822a-61a615439f42",
          "description": "Upon further investigation, we discovered that a threat actor had accessed data including Dropbox Sign customer information such as email addresses, user names, phone numbers and hashed passwords, in addition to general account settings and certain authentication information such as API keys, OAuth tokens, and multi-factor authentication.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:f779aae98dfe32ac3846a23c71516f0bd341ec061b48eea835906e1b57cda2db"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Phishing of an employee impersonating CircleCI; GitHub access token stolen."
      }
    }
  ]
}