{
  "type": "bundle",
  "id": "bundle--aa052d32-246f-5d37-89f1-bb9ebad4e1fe",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--d1cd632f-ab07-57e4-8e30-75a78e64f050",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:b3807646-dfb2-59c7-8a1e-46e11415cabe",
      "name": "Kaseya VSA",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--096f746d-e2e9-5f24-8735-355f657973a2",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:01937782-f438-572f-ba4c-c89fd45087f8",
      "name": "Kaseya VSA security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--a2c4bc60-05d9-5e09-8631-36908b7d4c4f",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:6b51a309-65e2-538d-bf8f-c8a2ada69b41",
      "name": "Kaseya VSA security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82ec7839-0d1d-5723-879e-c795985c754e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:285da9a6-ca32-5af7-a464-3f0c23f9c83e",
      "relationship_type": "affected-organization",
      "source_ref": "incident--a2c4bc60-05d9-5e09-8631-36908b7d4c4f",
      "target_ref": "identity--d1cd632f-ab07-57e4-8e30-75a78e64f050",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kaseya",
          "url": "https://www.kaseya.com/press-release/kaseya-responds-swiftly-to-sophisticated-cyberattack-mitigating-global-disruption-to-customers/",
          "external_id": "cit:3a992ba3-724a-5b16-9404-1fa3b52fd1d7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2c4bd8439e8b3d5876b91b8e887e81d07da0a43d7c3a6a6489abe5192033f17d"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--05bb14c7-c739-5bbc-8f40-d4199989c8a6",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:06d3457f-795b-57e6-960d-441c803c5790",
      "confidence": 86,
      "external_references": [
        {
          "source_name": "Kaseya",
          "url": "https://www.kaseya.com/press-release/kaseya-responds-swiftly-to-sophisticated-cyberattack-mitigating-global-disruption-to-customers/",
          "external_id": "cit:4d7e4392-4992-592d-8f54-d2e632949a30",
          "description": "NEW YORK and MIAMI, July 05, 2021 — Kaseya, the leading provider of IT and security management solutions for managed service providers (MSPs) and small to medium-sized businesses (SMBs) responded quickly to a ransomware attack on its VSA customers launched over the Fourth of July holiday weekend.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2c4bd8439e8b3d5876b91b8e887e81d07da0a43d7c3a6a6489abe5192033f17d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "REvil; zero-day in VSA supply chain."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3202b373-17eb-540c-8db2-f6730c813e4a",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:71e609fe-f64f-571c-97ed-9327fd9c76f9",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1195/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4ecca1cd-824f-519b-8134-22acba2bdc21",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:a3bddae2-afd7-5deb-a806-0a2266b10d7a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kaseya",
          "url": "https://www.kaseya.com/press-release/kaseya-responds-swiftly-to-sophisticated-cyberattack-mitigating-global-disruption-to-customers/",
          "external_id": "cit:33cbe4d7-7698-56a9-8a33-ce28af5b9a88",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2c4bd8439e8b3d5876b91b8e887e81d07da0a43d7c3a6a6489abe5192033f17d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the kaseya vsa security incident involving Kaseya VSA."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b4508c40-bc3f-5d31-860b-b3cbdc5a03f8",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:bef202c3-7e4d-5594-965b-04c6f16f3b3c",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1190/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--bdc3fcbe-c9f0-519d-815c-6b254714de4d",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:7cf386d2-e573-549e-9942-b85057cb3e6e",
      "confidence": 84,
      "external_references": [
        {
          "source_name": "Kaseya",
          "url": "https://www.kaseya.com/press-release/kaseya-responds-swiftly-to-sophisticated-cyberattack-mitigating-global-disruption-to-customers/",
          "external_id": "cit:1d6f810c-21cb-5b83-a9a1-5c3d8222ba3b",
          "description": "Of the approximately 800,000 to 1,000,000 local and small businesses that are managed by Kaseya’s customers, only about 800 to 1,500 have been compromised.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2c4bd8439e8b3d5876b91b8e887e81d07da0a43d7c3a6a6489abe5192033f17d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "approximately 1,500 downstream businesses hit via MSPs (e.g., Coop Sweden store closures)."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ea8b6e6f-5c0e-5a6f-8930-369cbcfe1f33",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:6b6647c9-e156-5230-8ed7-036f29a9787d",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Kaseya",
          "url": "https://www.kaseya.com/press-release/kaseya-responds-swiftly-to-sophisticated-cyberattack-mitigating-global-disruption-to-customers/",
          "external_id": "cit:e184f640-e960-5d30-b0ea-2f44cd7083e7",
          "description": "After making the rapid decision to shut down access to the software, an internal incident response team, partnering with leading industry experts in forensic investigations, sprang into action to determine the nature of the attack.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2c4bd8439e8b3d5876b91b8e887e81d07da0a43d7c3a6a6489abe5192033f17d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes containment action intended to limit further access or disruption."
      }
    }
  ]
}