{
  "type": "bundle",
  "id": "bundle--7e0c28b2-870d-5b32-82ac-c627c2ee6369",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--5c8eaef2-3c46-595a-848c-879eec9f4208",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:3ffa6d56-9460-55ed-90f3-b748ee12c50f",
      "name": "Microsoft",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--1b24b7dd-a08b-56fb-8364-0606f426a29e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:b4c08fa7-7fa4-5b15-94ea-fb09385b9e48",
      "name": "Microsoft Midnight Blizzard compromise"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--f7faa190-b399-5f4d-8637-e12e52b1c0b6",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:9f6c6d92-18ad-59ac-9e76-90891112f4a6",
      "name": "Microsoft Midnight Blizzard compromise"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bad8889a-0f7b-573b-841e-76c6f1ef4a7a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:bdeb2179-2bf3-5a27-813a-a2b40aefe44e",
      "relationship_type": "affected-organization",
      "source_ref": "incident--1b24b7dd-a08b-56fb-8364-0606f426a29e",
      "target_ref": "identity--5c8eaef2-3c46-595a-848c-879eec9f4208",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Microsoft",
          "url": "https://www.microsoft.com/en-us/msrc/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard",
          "external_id": "cit:425bf3a2-e2fd-5238-ab4d-93761b9a28ec",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8d145f9daff773424578a2c0461bbae8bf1c23e3bc67cf4ab1ec8457c6232609"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--21ed50bd-89cb-5fda-85df-03391c23d2f8",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:21ce3669-7853-5b7c-9919-a86226a131a9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Microsoft",
          "url": "https://www.microsoft.com/en-us/msrc/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard",
          "external_id": "cit:29bc4ca3-8409-5d76-a928-54b5c852fc43",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:8d145f9daff773424578a2c0461bbae8bf1c23e3bc67cf4ab1ec8457c6232609"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the microsoft midnight blizzard compromise involving Microsoft."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6bee580e-3776-50f3-8f37-a54e5a6ccc73",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:8fc89b14-783d-5236-9662-5516e56ed34f",
      "confidence": 85,
      "external_references": [
        {
          "source_name": "Microsoft",
          "url": "https://www.microsoft.com/en-us/msrc/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard",
          "external_id": "cit:2c35629a-386d-5b5f-95ae-44d014a9e69b",
          "description": "This has included access to some of the company’s source code repositories and internal systems.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:ebe59850d6aa9d4199a7d5fb6c813434c2fbe7a2a9c1bc73e2093c96c5130d51"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Accessed senior Microsoft leadership email; used stolen info to probe customer systems and source-code repos."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f43d6291-2b1c-5fe4-88ca-4cc2866e2f35",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:749e1eb9-f3cc-5f1d-8f17-dd5ea7ee5f2b",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Microsoft",
          "url": "https://www.microsoft.com/en-us/msrc/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard",
          "external_id": "cit:b44eb8e2-1274-5bd4-bce0-1ea2abfd3be6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:ebe59850d6aa9d4199a7d5fb6c813434c2fbe7a2a9c1bc73e2093c96c5130d51"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2024-03-08"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--bcfc8947-e4c3-5a6c-8d58-fdf58f67de0e",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:4982e6be-7677-5970-8734-2fe70b6e338e",
      "name": "Documented public update"
    }
  ]
}