{
  "type": "bundle",
  "id": "bundle--e46d9811-9df3-56de-816d-47749f1e948f",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--978eb36f-cf8d-5f8e-8d4b-26be021556ab",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "org:b589342d-095b-4775-a182-b5b999819a7c",
      "name": "HM Government of Gibraltar",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--75db6131-1c2f-5ee4-8bf6-39923a7cfb9d",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "brh:62e3a362-ec5f-447a-9d3f-89d3c72ffeb7",
      "name": "Gibraltar government cloud intrusion"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--f38cccb2-7f84-5308-87e0-d08afa9c9928",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "inc:c3da4738-d183-4d11-a87c-457ce7983d42",
      "name": "Gibraltar government cloud intrusion"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--360007b2-8e55-57b9-8428-70ce1fd75090",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:1ee3b223-71f4-469f-bf46-0e999d144b37",
      "relationship_type": "resulted-in",
      "source_ref": "incident--f38cccb2-7f84-5308-87e0-d08afa9c9928",
      "target_ref": "x-ally-event--2da0e93e-e8e2-514c-8a3c-df72a084473e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:6d3fddaa-25e8-4b5a-8ef9-624ba0166b35",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8d125636-deeb-5276-8870-0a69904953e3",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:ffc2363f-6cd3-4694-8896-3b9f0d92490a",
      "relationship_type": "resulted-in",
      "source_ref": "incident--f38cccb2-7f84-5308-87e0-d08afa9c9928",
      "target_ref": "x-ally-event--f26303e5-186f-5ab9-8dbd-c1c6e7e96e6b",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:13bc8223-3c2b-42d1-a7e4-3a8091d4cbdd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a781c1b5-d76c-5c5a-8903-5a918b7e6b55",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:89cbe492-63aa-43c4-b433-c7023405fe17",
      "relationship_type": "resulted-in",
      "source_ref": "incident--f38cccb2-7f84-5308-87e0-d08afa9c9928",
      "target_ref": "x-ally-event--ef89c560-c941-5d2a-8a20-a345bf5168bd",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:c4174bee-e71e-4c10-b199-871634ea5e09",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e17843e7-2489-58c2-8c09-526db0b32bec",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:105069ec-0b80-4a5d-8647-3a98c72ac227",
      "relationship_type": "affected-organization",
      "source_ref": "incident--f38cccb2-7f84-5308-87e0-d08afa9c9928",
      "target_ref": "identity--978eb36f-cf8d-5f8e-8d4b-26be021556ab",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:38cc29db-8588-4d3a-9964-937b82b47608",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0c80c966-8802-53db-8694-3089e129df2b",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:163e4d59-d448-4dc9-9bde-3ed8e74f581e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:bd506759-6cb3-441a-ba96-b4881446fb46",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "On November 9 the government said containment measures were in place, continued access attempts were blocked and monitoring showed no further successful cloud-account access."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--40d6f31f-d19c-5804-836a-35653fb68c14",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:d0e8272b-3ae7-42e9-bb1a-6c89494c0a48",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:523363ce-96bd-42f7-a8fe-08d833e09b3f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-02"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--613ea836-55c0-5a13-815d-ec6c63cdaf23",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:44a1486d-1573-4cc2-a247-5d9fd43b2e7e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:e93d866e-9d3b-465d-ba7f-40a7971e34d2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Microsoft alerted ITLD, which began containment. NCSC coordinated external specialists who arrived November 2."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--771404d4-e6c0-5df8-85b1-c7a3d065bd12",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:57bbcd45-dac1-4298-9e88-c9df6fc98c2d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:197c40a7-4fa6-411b-bbba-85f4221552c2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-09"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b94c5fa1-8d51-5337-8489-286622c9ee86",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:30b14f3b-283f-4a0f-bbdc-9fbad5bb03cd",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:7afd1399-5259-4b7e-ab71-7b26cb30750a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Principal resident-record databases are hosted separately on local infrastructure. Investigators had not yet determined whether email or document information was accessed or extracted; affected people would be notified if confirmed."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c82e3fd6-d66e-5acf-86aa-676c629e986a",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:362d636f-ecd9-4caf-b245-a27b5e4e79f2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:891a7480-8c5a-4808-aa47-ba94eb51011b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Some public services were suspended November 6 for forensic investigation and additional security controls."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e8569af6-24fc-57d6-81e4-65832d62fde6",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:6542d018-d5ba-4a83-a4a5-4f7548146c95",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:e8d935e9-8cc2-4836-ba6d-6b3473c203ce",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-06"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--efbfe848-a259-5f31-826f-b6b566a0198f",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:0e660443-4280-4af5-a9e7-9120284a73cd",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:d6519574-8e2e-4d02-89d5-6281ced4a141",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The government confirmed unauthorized access to its cloud environment, including Outlook, Teams, SharePoint and OneDrive, beginning several weeks before November 9; no exact intrusion date was given."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ff69949b-bb01-5f04-81c2-61989e7b1314",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "clm:de4f91df-701d-4e0f-84e8-9f4cc233af95",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "HM Government of Gibraltar",
          "url": "https://www.gibraltar.gov.gi/press-releases/government-confirms-cyber-security-incident-contained-following-extensive-security-measures-8652026-12551",
          "external_id": "cit:b214bfd0-1f63-49f6-ad4d-85034a7acd67",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:81afde49081905b8d331afbe00cc9fdd8911398b9057cd9130942280df15e52b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-09"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--2da0e93e-e8e2-514c-8a3c-df72a084473e",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "evt:b7623df6-5e53-46bf-8f46-c34d4cb2ccbd",
      "name": "Government confirms cloud intrusion"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--ef89c560-c941-5d2a-8a20-a345bf5168bd",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "evt:692ae9e7-782d-4ff4-ad53-46526ba2e0b8",
      "name": "Public services suspended for investigation"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--f26303e5-186f-5ab9-8dbd-c1c6e7e96e6b",
      "created": "2026-11-10T14:06:19.700800+00:00",
      "modified": "2026-11-10T14:06:19.700800+00:00",
      "x_ally_original_id": "evt:cdc2f44c-abfb-42cf-b2b6-911c839ca1e7",
      "name": "NCSC partner specialists arrive"
    }
  ]
}