{
  "type": "bundle",
  "id": "bundle--56a96b21-7f7a-51c3-802e-9838d67d8ca5",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--f39d23f3-bf9f-5941-83f4-f956b73190ba",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:d471ede3-4daf-50e4-8bb3-fe0cdb16c7fa",
      "name": "Industrial and Commercial Bank of China Financial Services",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--aa521ef5-adcf-5baf-8968-4c6bef49fc4e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:eb042723-fbaf-57a9-ab13-dab0f0b311d6",
      "name": "ICBC (US arm) security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--e999b940-1f19-5843-8a42-4f329ceeca06",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:27d94c3e-9bf5-50bc-bc73-efb88003d5aa",
      "name": "ICBC (US arm) security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5dfda9c-bc09-5d3f-8fe4-8eeed56ffc8a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:3efd7740-511e-5cae-81cc-35c13a614076",
      "relationship_type": "affected-organization",
      "source_ref": "incident--e999b940-1f19-5843-8a42-4f329ceeca06",
      "target_ref": "identity--f39d23f3-bf9f-5941-83f4-f956b73190ba",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. Department of the Treasury",
          "url": "https://home.treasury.gov/news/press-releases/jy2114",
          "external_id": "cit:313531f2-0098-557e-b4a9-9e8c5a64b77f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d32daa1d637e7b157ae7ff64cae50ba308d8499aeefb76c95f10eefad93d1f42"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1cce75d3-44e0-50b2-8847-35366017f379",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:842467ba-ac98-5be7-997a-d53bb4e98f05",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1486/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--738ccec4-8479-5445-8a14-1911ae4618f2",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:627a1169-a517-5bfb-a02d-50f7018156ba",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. Department of the Treasury",
          "url": "https://home.treasury.gov/news/press-releases/jy2114",
          "external_id": "cit:889fbcbd-101a-5322-96cf-1e57c20ad88a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:d32daa1d637e7b157ae7ff64cae50ba308d8499aeefb76c95f10eefad93d1f42"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the icbc (us arm) security incident involving Industrial and Commercial Bank of China Financial Services."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8cfdaa2a-040d-5f1c-89c4-b9e9cf526f85",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:be09b1bb-4bb6-5ad7-a1c9-6934871f77f3",
      "confidence": 85,
      "external_references": [
        {
          "source_name": "U.S. Department of the Treasury",
          "url": "https://home.treasury.gov/news/press-releases/jy2114",
          "external_id": "cit:fc713bbe-deea-5fe3-8c32-9413d863e82f",
          "description": "The ransomware attack disrupted ICBC’s U.S. broker-dealer, affecting the settlement of over $9 billion worth of assets backed by Treasury securities.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c291e1716b54a2047eed0e395ee32383c469379730c5cb3c6e8a63e5fb19ac8b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Disrupted US Treasury market clearing/settlement; trades settled via USB courier as a workaround."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d26bf8c0-6a3c-5a1e-8627-2093e1682965",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:870853c4-c9a0-58e1-accf-e6b72d4a3de8",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "U.S. Department of the Treasury",
          "url": "https://home.treasury.gov/news/press-releases/jy2114",
          "external_id": "cit:671e49fd-6db3-5193-a375-8aed60bbb8e8",
          "description": "United States Sanctions Affiliates of Russia-Based LockBit Ransomware Group",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c291e1716b54a2047eed0e395ee32383c469379730c5cb3c6e8a63e5fb19ac8b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "LockBit ransomware."
      }
    }
  ]
}