{
  "type": "bundle",
  "id": "bundle--c3e1a572-78c3-534c-86d6-5a8b9f2464a9",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--3d0ae47a-dc08-5729-8cda-b0389c94270f",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "org:e70df61c-7970-45b6-ad8c-9f72e0e4e008",
      "name": "Kernel",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--170cbe24-bb9c-53b7-800e-3c1b994284c0",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "inc:67cd5dec-30d7-4391-9bf5-e2f013f2e191",
      "name": "Kernel logging and hosting credential incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--419687f8-4ad1-5a26-878c-175d849abce8",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "brh:d371180b-022b-4dd7-abb2-bfff37cbc69a",
      "name": "Kernel logging and hosting credential incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1bae372e-4de5-54c1-84f6-f0195253dcc9",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:75b20660-414a-4d78-b1ce-b571b9fa1802",
      "relationship_type": "resulted-in",
      "source_ref": "incident--170cbe24-bb9c-53b7-800e-3c1b994284c0",
      "target_ref": "x-ally-event--a3c61bb3-eae8-56c4-861a-868cec84f977",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:9054401b-d76b-405f-ae6d-161270ca8f2e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3369ecc6-689e-5d54-89c6-9edef2d354a3",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:e5489d45-2f2e-4dbe-ab37-b53e40bcab78",
      "relationship_type": "resulted-in",
      "source_ref": "incident--170cbe24-bb9c-53b7-800e-3c1b994284c0",
      "target_ref": "x-ally-event--1b67b452-8f91-53a1-8d0a-81215a95dd80",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:872bff2d-2a04-4e3b-a1a8-1c0d192fa102",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3582823d-9ae0-5e8d-8c25-c7f24ba44934",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:0097aa88-106f-4a30-b385-c36d27d4c6af",
      "relationship_type": "affected-organization",
      "source_ref": "incident--170cbe24-bb9c-53b7-800e-3c1b994284c0",
      "target_ref": "identity--3d0ae47a-dc08-5729-8cda-b0389c94270f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:a5af9925-eafb-497e-9efe-aceb9cc683d7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51114af3-04d1-5855-88ca-08f84baf4395",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:dd34886f-7850-4fce-a77f-778ea1aad629",
      "relationship_type": "resulted-in",
      "source_ref": "incident--170cbe24-bb9c-53b7-800e-3c1b994284c0",
      "target_ref": "x-ally-event--13d3821a-e96f-507a-875f-39be135688bf",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:3d236490-b537-475c-8882-2f1facf8e057",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5d35ddff-a61a-5594-8784-59b356b2ba82",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:cc86ffea-e5a0-4db6-a5b9-f4c275304520",
      "relationship_type": "resulted-in",
      "source_ref": "incident--170cbe24-bb9c-53b7-800e-3c1b994284c0",
      "target_ref": "x-ally-event--c1ae8318-004f-5a91-8c3f-b8c16667642f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:4f6b08a7-eacf-405d-9a3a-2f9a880b3131",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0a630f7f-26ab-5ed2-8a11-834bf10c390b",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:08df4055-2541-4752-a6f1-76f8c876dd22",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1496/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2c5795a4-7e09-547f-8f7b-a61bb7c1f14c",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:9704bcaa-e6b0-4b04-9550-30d82f463759",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:66b05a5d-098e-4816-a200-976d0c68c0af",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Kernel detected the incident on November 2, revoked credentials, removed access, isolated servers and notified exposed organizations. Response and recovery work continued through November 4."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4e09286f-771b-5a3e-8adb-b521a51dcf4d",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:288f3991-e49a-4c5c-b69e-a9ac52e316d5",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:0b05721f-8439-416f-9af5-0215cd766624",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-27"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--68e2001f-9acd-5f17-8a0c-2e1b61734da2",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:41b6af0a-03b7-48f4-b309-ff957cbb25e3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:44e0d194-8a35-438a-8ac2-e14beff88860",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "A cryptominer ran on the development server, with further starts attempted on other servers."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--774dd33a-0553-5c56-8ef7-ad4e797c541e",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:f258e30c-e1ec-4195-b16e-fbf008908cd3",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:cf5eb2b9-933f-42e8-8ebd-4db6799ccb1d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The key was used on October 24 and to reach a logging-provider staff login on October 27. On November 3, a compromised hosting-account credential enabled access to four GPU servers."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8d209345-2d50-50d5-860e-17e644f14a1f",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:423bbf33-ce01-44b4-a5fe-d29a9f7327f1",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:2afe3db3-e7b4-4ba0-a800-d850838849f7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Kernel reported that a compromised API key led to access to its logging provider and a download containing API keys and deployment secrets."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--93a66943-d411-51f4-87e8-855cee82f713",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:b7bf793f-2a51-4ec7-9862-7b5b3dc985ba",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:d15a5706-b07b-4075-9bb8-dc3fd472f6df",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-04"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9626bc73-fe42-515d-8c77-d2c5216f33ed",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:b21c2f4e-3647-4f84-853d-324a74065c01",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:3defd8e7-11c7-4824-a680-b9e9f739e687",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-02"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ad576132-221a-5be6-8693-9e6c4aa60f36",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:a9daebc8-ff4b-4c83-a1ef-37ef49f677f0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:df1562f0-f87d-4c27-9e5b-b35249fddd95",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-04"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--af6b673e-7050-54f9-8994-c66dd99d736d",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:7b555e0e-5fa2-4d6a-9b21-8a8cb6c751ec",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:e637e070-9606-4ddc-82ba-8e31c1433ebc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Three servers ran customer browser sessions; the fourth was a development server without customer data. Kernel reported 0.28% of customers affected, without publishing a customer count."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c279558a-a257-5a43-8902-0f84c77343c2",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:a8706ee6-3ae8-4d6f-bbbe-a9bb928be317",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:ebec82f9-a3ba-4b59-a9b0-c7ff235007e8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-02"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cd3cc71b-c9bd-58b2-84e2-556a22f8a1f0",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:b32fab6c-d2b6-4c6a-a200-f7d32917bc58",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Kernel",
          "url": "https://dev.kernel.sh/blog/public-notice-of-security-incident-nov-4-2026",
          "external_id": "cit:45e17420-575d-4b9a-80bd-ef7437a1295b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:43f912149c897bc19965a491a472b96a1f232f71ca85060851eae659b834a0ea"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-03"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d0fe0347-4623-5046-8441-af1587595a21",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:0472af10-dd45-4dbf-bcb0-5080f0e128c2",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1078/"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--13d3821a-e96f-507a-875f-39be135688bf",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "evt:18e5c14b-612d-4430-ab78-e4063f88f2b0",
      "name": "Logging data downloaded"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--1b67b452-8f91-53a1-8d0a-81215a95dd80",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "evt:3dd78d4e-6ed0-4c04-be33-4960f6fbef00",
      "name": "Incident detected"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--a3c61bb3-eae8-56c4-861a-868cec84f977",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "evt:3f7f046c-7566-4f9a-8e11-9fa812b80557",
      "name": "Public notice issued"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--c1ae8318-004f-5a91-8c3f-b8c16667642f",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "evt:0d23d82a-afc7-47ce-ad9e-f9ff23b6a236",
      "name": "Hosting servers accessed and isolated"
    }
  ]
}