{
  "type": "bundle",
  "id": "bundle--fe03d390-4c01-5aa6-871c-f9d699cb3817",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--b5885c9b-b990-55c0-8d88-56182ce19548",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:1c7a4064-a0f4-5c85-9c75-b49c69057205",
      "name": "Google",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--48fe0065-9e0f-5008-8d48-836ffc9b72df",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:00f1ca96-d558-55f8-80a7-e63b0588106f",
      "name": "Google Salesforce data theft incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--659cebea-928b-5d94-8ebc-a502cd4bed9b",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:ec80f0df-8716-5c8d-8428-9a43c56fe97f",
      "name": "Google Salesforce data theft incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ae8a1c4-65f4-5448-87e5-2b02f7f99fc2",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:36484f6a-79f4-5157-a6b6-ba065d1d5835",
      "relationship_type": "affected-organization",
      "source_ref": "incident--659cebea-928b-5d94-8ebc-a502cd4bed9b",
      "target_ref": "identity--b5885c9b-b990-55c0-8d88-56182ce19548",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion",
          "external_id": "cit:9110f5c8-7aed-59b4-9887-a91c6908a6ce",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:ca919ce2909a697565330253001afaeed70f53908fec6a8b0b4db6181e8cdd01"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6701bddd-d7e8-52ac-8ccf-2b974d5a38a9",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:e5f287fa-c4ee-5117-87de-feebd496d750",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion",
          "external_id": "cit:c41ea4e1-50e5-57f7-bfde-d3b84e3bac89",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:ca919ce2909a697565330253001afaeed70f53908fec6a8b0b4db6181e8cdd01"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the google salesforce data theft incident involving Google."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--75b4f66a-b259-57aa-866f-7030f324f945",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:48293cb0-ebf0-5a27-a6db-cf7c49b7a439",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion",
          "external_id": "cit:d41a9130-e73c-56d5-a696-b76713a07b77",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0655c4754aa527840bc3db89f5f3f4669dd8bc2a7b73fe559169f7ad668868b2"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2025-06-04"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c616e9c2-3530-5694-867e-647e7808c178",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:38be3613-88d0-5ca9-bc3b-0c2dbfa54a85",
      "confidence": 87,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion",
          "external_id": "cit:f915cf8b-d943-57ed-a4a2-8c3a2859f35f",
          "description": "The instance was used to store contact information and related notes for small and medium businesses.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0655c4754aa527840bc3db89f5f3f4669dd8bc2a7b73fe559169f7ad668868b2"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Small-business contact data from a corporate Salesforce CRM instance exposed."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e53f3e7a-ecec-5fc7-8977-6d5cc1dd6219",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:2aa49b9e-d95a-5ab4-8a19-1523e75ee2de",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1566/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ff49865c-50aa-5623-833d-bc3e98f93b9d",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:24bb017d-7a46-5eca-ab79-cfe0eecc32c5",
      "confidence": 87,
      "external_references": [
        {
          "source_name": "Google Threat Intelligence Group",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion",
          "external_id": "cit:ec440fd1-d1b8-555a-ad9b-583110e7160a",
          "description": "The application supports OAuth and allows for direct \"app\" integration via the \"connected apps\" functionality in Salesforce.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:0655c4754aa527840bc3db89f5f3f4669dd8bc2a7b73fe559169f7ad668868b2"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Voice phishing induced personnel to authorize a malicious connected OAuth application in Salesforce."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ff599f32-7d0e-57ce-8ed5-83f09665794e",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:7ef77c3f-eb35-5a20-9958-e2d5f1aa32e9",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1528/"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--a49ea942-b164-576d-82df-e0abfe6b3dea",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:7a29a5be-c32c-516a-9088-439258af43af",
      "name": "Documented public update"
    }
  ]
}