{
  "type": "bundle",
  "id": "bundle--63f1c812-414f-5145-8e4c-4a64b5646806",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--8b467c33-58b7-5277-8ea2-d8b5c6b18b2a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:2a9f8441-f283-5602-a08b-15be4f7dc20d",
      "name": "Marks & Spencer",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--7669b9b1-8c5e-5dae-8b56-db1e7c3c96ed",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:7f6fa201-db60-5bbc-b73c-a25c0ae79e81",
      "name": "Marks & Spencer security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--7a7ed4ea-7307-5df7-88a7-c6ab4b2c23c6",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:c478f452-c365-56d6-afc0-ae1b25541bb4",
      "name": "Marks & Spencer security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--748357b4-1eae-5b1f-89a5-41557aeaefc5",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:7ae59762-6ac3-5653-8b16-030d93a05c66",
      "relationship_type": "affected-organization",
      "source_ref": "incident--7669b9b1-8c5e-5dae-8b56-db1e7c3c96ed",
      "target_ref": "identity--8b467c33-58b7-5277-8ea2-d8b5c6b18b2a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Marks & Spencer",
          "url": "https://corporate.marksandspencer.com/sites/marksandspencer/files/05-2025/fy25-rns.pdf",
          "external_id": "cit:64705f26-0c61-506b-a2f2-eb523a75d898",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:220658b99e3e4df6cec7bcfc987fb00bbb786b5aa394eb4900cbe07876d74cd8"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--074a0625-dea2-57ac-8af6-c0325a5f51f2",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:c6753f8d-9358-5b84-a0fa-80c796acea82",
      "confidence": 83,
      "external_references": [
        {
          "source_name": "Marks & Spencer",
          "url": "https://corporate.marksandspencer.com/sites/marksandspencer/files/05-2025/fy25-rns.pdf",
          "external_id": "cit:3aef5d97-d9aa-50e2-9558-4aa08b70daa2",
          "description": "The Group received a net credit of £20.5m as part of a legal settlement in relation to damages received from an independent third party following its involvement in anti-competitive behaviour that adversely impacted the Group.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:220658b99e3e4df6cec7bcfc987fb00bbb786b5aa394eb4900cbe07876d74cd8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "DragonForce ransomware / Scattered Spider social engineering; initial access reportedly via a third-party contractor (TCS)."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7e29ff6e-4c91-5e92-8ad4-807fea6ce6df",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:66502d4d-d2da-558d-b257-c6d8f7fce02a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Marks & Spencer",
          "url": "https://corporate.marksandspencer.com/sites/marksandspencer/files/05-2025/fy25-rns.pdf",
          "external_id": "cit:5900c730-8522-5061-a00e-50b754c72c5e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:220658b99e3e4df6cec7bcfc987fb00bbb786b5aa394eb4900cbe07876d74cd8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the marks & spencer security incident involving Marks & Spencer."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a808eb2c-0f25-56e0-89cc-ddfa078c0a8d",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:68e5ec37-3487-56dc-b6b8-03cc87fb56d5",
      "confidence": 92,
      "external_references": [
        {
          "source_name": "Marks & Spencer",
          "url": "https://corporate.marksandspencer.com/sites/marksandspencer/files/05-2025/fy25-rns.pdf",
          "external_id": "cit:519ee3a8-4d55-5e79-a360-48a50dfaff01",
          "description": "M&S has net funds of over £400m and we are in our best financial health for nearly 30 years.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:220658b99e3e4df6cec7bcfc987fb00bbb786b5aa394eb4900cbe07876d74cd8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Est. £300-400M."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ab943c43-f4fb-56f2-84e4-549fba7600a2",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:72fc1736-d0c4-5e46-acc8-2c8716996bf2",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1486/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b01b76b0-77de-5788-8b1a-96fd38b9a2a7",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:775f32cf-b359-5540-9363-f9cbf1d75da3",
      "confidence": 83,
      "external_references": [
        {
          "source_name": "Marks & Spencer",
          "url": "https://corporate.marksandspencer.com/sites/marksandspencer/files/05-2025/fy25-rns.pdf",
          "external_id": "cit:8706a572-1a48-5b07-a536-bc3706654a06",
          "description": "LFL sales up 4.4% in 2024/25. • International resetting for future growth, developing a capital light operating model. • Structural cost reduction of c.£120m in 2024/25; ambition to achieve cumulative savings over £500m by 2027/28. • New Food and Full Line stores opened in last three years generating paybacks ahead of hurdle rates. • Increasing capital investment in 2025/26 to £600m-£650m net of disposals to fuel growth and resilience. • Expected cyber incident impact of c.£300m on 2025/26 operating profit, before cost mitigation, insurance and trading actions.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:220658b99e3e4df6cec7bcfc987fb00bbb786b5aa394eb4900cbe07876d74cd8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Online ordering halted approximately 7 weeks; contactless payment and click-and-collect disrupted; first-ever profit warning tied to cyber."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d84b68cc-17b4-56c1-8ad9-94f96b3330cc",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:5ba97413-10fb-53b5-a74e-08efec1d946d",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Marks & Spencer",
          "url": "https://corporate.marksandspencer.com/sites/marksandspencer/files/05-2025/fy25-rns.pdf",
          "external_id": "cit:55311e4b-545a-58d4-be83-d2884fd7cb7f",
          "description": "In response to the events, we engaged external cyber security experts to assist with investigating and managing the incident.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:220658b99e3e4df6cec7bcfc987fb00bbb786b5aa394eb4900cbe07876d74cd8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes a forensic or specialist investigation of the incident."
      }
    }
  ]
}