{ "type": "bundle", "id": "bundle--6df818da-a841-5c63-8600-4aeb5e1b452d", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--cc115d8f-3bf3-5b29-8ef9-bb509d517de5", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "org:64ed91bf-8587-4781-b298-6e1077df9ce4", "name": "GMO GlobalSign", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--99b2c59a-0db5-50b6-80e9-4ae6b8f93ad1", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "brh:5726bb85-6251-43ef-9977-eabc6e277dae", "name": "GMO Trust Login public-storage data exposure" }, { "type": "incident", "spec_version": "2.1", "id": "incident--d77bce5e-4950-514e-8394-5b94242de0aa", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "inc:a89d4a16-165f-40d5-b0b3-eb259223359c", "name": "GMO Trust Login public-storage data exposure" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4749b2a8-2c39-5193-8a75-ebba5ad5f522", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:e1652f42-5c46-47b6-830b-b110a3b54f9b", "relationship_type": "affected-organization", "source_ref": "incident--d77bce5e-4950-514e-8394-5b94242de0aa", "target_ref": "identity--cc115d8f-3bf3-5b29-8ef9-bb509d517de5", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:fa1dc67c-66ac-4430-accb-0e9655e4a137", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aaf5471f-6376-5595-8ef3-f6ed3aef5e3f", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:83a945be-1f40-40ad-b5d4-063f76f830e0", "relationship_type": "resulted-in", "source_ref": "incident--d77bce5e-4950-514e-8394-5b94242de0aa", "target_ref": "x-ally-event--b31fbc89-1a17-5fae-85a4-d5c2f4a837eb", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:8760235b-bbf9-4d10-90f4-58b8306f9a26", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--af0a1dd9-a2c6-527b-804b-8400440d7b3d", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:fa09de5e-e637-4cbd-8b0c-334c23263dd1", "relationship_type": "resulted-in", "source_ref": "incident--d77bce5e-4950-514e-8394-5b94242de0aa", "target_ref": "x-ally-event--57f23fd2-241a-5f28-8292-29b1980240b6", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:6d26aca2-a09f-4fe1-b695-af53cc04c99b", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd4e73e3-cf21-5395-8916-6b2c8fc6c9ba", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:37d64759-0e0e-4cef-b127-81a85c143be8", "relationship_type": "resulted-in", "source_ref": "incident--d77bce5e-4950-514e-8394-5b94242de0aa", "target_ref": "x-ally-event--6e63af76-43fa-5049-8105-01a259bbf36e", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:8463d97b-ae9d-4561-ad87-31b9e6ffc005", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e4fd3c5c-cb6f-540b-81f8-921aaf4be571", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:6955c607-734b-4b9e-8ed7-7d1d6a017af9", "relationship_type": "resulted-in", "source_ref": "incident--d77bce5e-4950-514e-8394-5b94242de0aa", "target_ref": "x-ally-event--506afdea-1ac6-5e34-88df-62510e8a0186", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:6c149c1c-6ab3-4209-918b-d57941b21579", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--027744d3-2545-536b-8164-5754d76805a7", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:014f97c7-cd50-49f5-9581-1af2d4cbcc7e", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:c721a96c-0bfa-4da1-8086-2f31db1a9410", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The completed investigation counted 45,030 people at 2,492 companies; people were deduplicated by email address." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--11d353fb-113f-5f7e-8531-6d89ed1a074f", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:68dd9bc6-de84-40b4-8986-a44390e04dce", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:c17bed11-ce3f-4bbb-a312-a63cb1c8d492", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-09-14" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--1483b0fd-4505-522d-82bd-9147591a8f3a", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:2081465f-fc57-4774-bebd-a545e2637fbe", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:b2576711-b9ae-4350-b69d-41fa3bd21951", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Files were publicly retrievable from approximately November 14, 2017 until September 15, 2026. Downloads were confirmed in logs from June 8, 2021 onward; earlier logs were unavailable." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--19c7a16f-d8d1-5aa3-8d0e-b47655881898", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:9535e4d5-22df-4905-9f8b-5fbb7a4679f1", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:cae08443-75f3-434f-9cfb-2489ef620d4f", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-09-16" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--31f7896a-94e7-5431-80c7-16e9147201e4", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:96bfb0c1-1a5e-42ef-86d1-8d6812b1a859", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:ae12b049-ef7e-4a1c-bfdd-db44b509839c", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-09-15" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--4eedcbbc-cebe-55fc-8d8c-aadd9e4847f0", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:668e34b3-041b-46a1-bc8a-7a0828a39f4e", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:5daafdd4-7dc7-4c61-83e7-aa8a2627f546", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-09-14" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--61ca5e10-0360-5bcd-8281-b2444ceefb4c", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:811a3e28-586b-4678-b898-3673c7ab4695", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:cbfffea0-0dc6-432c-8e32-045a0de52a10", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-09-16" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--68ba6276-5a11-5dcc-838d-814d9c91d8ae", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:4a53e861-badd-4bec-bb2b-e314ad067110", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:8b9b2094-5b94-442d-8599-f29f9e921a6a", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "integer", "value": 45030, "unit": "individual" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--7556a75b-44d7-5260-8204-0c5077b548d2", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:0f066002-5d10-470e-99dc-b0232205f7b6", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:04546c3e-2e84-45dd-bfa0-1dec68496556", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-30" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--9f0c14b6-43b8-5752-8f39-c64a273518c0", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:e1b33213-85ce-4e8a-9492-7306991f8193", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:e02def9d-e09a-43d8-97c7-552581eb31bd", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "GMO GlobalSign’s October 30 report confirmed third-party downloads of customer files from storage used by GMO Trust Login." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--bbb529f5-7ffd-5f76-8364-a36581ea1a20", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:dcedf5a5-ca86-4401-95c0-43ea18845a81", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:9e26a0d7-070b-461d-b7e9-27f530f9b9cb", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Customer files shared public logo storage with directory listing and unsigned, non-expiring links. Storage had been outside routine testing scope." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--ed2be064-c05e-5d4b-8aa9-23e8cab9c504", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:17eabed8-c807-4669-8218-1ad64ce8b020", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:f57cf0ec-0c12-44c8-bd75-536b946198f5", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "After a researcher’s September 14 report, access was progressively blocked by September 15. Subsequent measures included signed expiring links, file deletion, disabling listings and storage monitoring." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--fcfff0f1-1561-5f0c-8b1b-5440cec1b111", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "clm:b710f18d-2c59-4cec-9b1a-821340327ede", "confidence": 100, "external_references": [ { "source_name": "GMO GlobalSign", "url": "https://news.trustlogin.com/20261030", "external_id": "cit:676bcf16-1ba3-484d-b8b7-b5292d7414da", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:a5d267d2ec881b949ac10d7e8fa9399ada0f3f94d4d25f3c42cade1a2eac4e7e" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Data included names, emails, linked applications, custom employee attributes and billing contacts. Passwords, security questions, MFA and payment data were excluded." } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--506afdea-1ac6-5e34-88df-62510e8a0186", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "evt:0ca0d98a-0df1-4d2b-8542-4c6c2e35d585", "name": "External retrieval blocked" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--57f23fd2-241a-5f28-8292-29b1980240b6", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "evt:d326475d-5d63-453e-9c62-7409d716641f", "name": "Final findings published" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--6e63af76-43fa-5049-8105-01a259bbf36e", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "evt:5565c02b-8e4f-4b38-a92d-c2f8c285f6be", "name": "First notice published" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--b31fbc89-1a17-5fae-85a4-d5c2f4a837eb", "created": "2026-11-03T14:05:45.510181+00:00", "modified": "2026-11-03T14:05:45.510181+00:00", "x_ally_original_id": "evt:34cb5b57-2a63-43d3-a8fc-298e2fc267d9", "name": "Researcher reports exposure" } ] }