{ "type": "bundle", "id": "bundle--c5ef72b9-e502-5cf9-8599-a2410fb6db6c", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--4ead2b02-d679-5a03-8fb9-307cd622f2a2", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "org:3480ded0-808e-4d39-b082-6a53a25fa4cc", "name": "The Ohio State University", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--68f6474d-6eae-5320-80fd-4909aed1496b", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "inc:4d9f2715-19bf-47f3-a288-3baead3e6cae", "name": "Ohio State Qualtrics account compromise" }, { "type": "incident", "spec_version": "2.1", "id": "incident--a2ba6837-66dd-589d-89c7-033d86c94567", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "brh:13a1471d-d116-4895-b25d-5c32b0943925", "name": "Ohio State Qualtrics account compromise" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0dd0f282-5251-51a3-8692-04a1d1b2acf4", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:37640955-8b26-4ee4-b2e0-ba0d4e125924", "relationship_type": "resulted-in", "source_ref": "incident--68f6474d-6eae-5320-80fd-4909aed1496b", "target_ref": "x-ally-event--07b30cbe-b3fe-5350-83ab-f400f22cb270", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:eb630a4c-d1c5-4e1d-858d-467184a3b822", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--21fab7f0-bca9-5088-8dfb-c55ec7dbe695", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:8053ae01-2038-4a36-940a-c029cf47efe5", "relationship_type": "used-product", "source_ref": "incident--68f6474d-6eae-5320-80fd-4909aed1496b", "target_ref": "software--23cdb97f-ad59-56ed-825a-af9f410fe9ad", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:72691c1f-dc7a-4fb5-9d22-d91e5b8de228", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6c5b6a8e-4d7c-5eda-81cb-85acce5c5460", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:066f10a6-9ad9-4b35-a85e-c22c720c4e6f", "relationship_type": "resulted-in", "source_ref": "incident--68f6474d-6eae-5320-80fd-4909aed1496b", "target_ref": "x-ally-event--c9824f30-d6ce-5a45-815c-cf73fded419c", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:491f0128-cba6-4707-8829-6e506c5a701a", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--901464d8-9079-50a0-8369-9525f5f87452", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:df7a137a-6679-436e-ab32-aa6ba6be848c", "relationship_type": "affected-organization", "source_ref": "incident--68f6474d-6eae-5320-80fd-4909aed1496b", "target_ref": "identity--4ead2b02-d679-5a03-8fb9-307cd622f2a2", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:b8b7b953-1cda-49fc-b425-5c13881cea96", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ] }, { "type": "software", "spec_version": "2.1", "id": "software--23cdb97f-ad59-56ed-825a-af9f410fe9ad", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "prd:addc36ee-ac83-477f-939d-4c537b6c5f70", "name": "Qualtrics" }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--071512f7-6cca-5c12-8577-e397460e7c27", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:9ff39e28-40b5-4958-a0e3-104aa8b21828", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:cf2de4d5-921e-45ea-87ba-2bde96bc8ac2", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Qualtrics automatically disabled the account after detecting suspicious activity on September 27." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--0a69095f-60ee-5743-8696-d77b17aeb1b3", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:69713190-64ca-4d08-b533-38982d25c221", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:faeb3bf4-659a-40ee-980c-52a40a8fdced", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-09-27" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--1478c390-d385-5fa4-86ac-86b7bac1add5", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:9f627e4a-e2ab-4d8c-845b-46c66fdcacee", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:8775047b-c9bc-466f-828e-e14354045f80", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "An unauthorized user controlled an Ohio State Qualtrics account and configured a survey and automated workflow to send phishing links." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--159b0599-2623-5ae0-8b8f-8ea4e95e07b4", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:bc13c417-ef25-4cfc-9851-60b6a0ac1d58", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:b231f159-4977-4ee4-90bc-ddc276fdab31", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Qualtrics detected suspicious activity and disabled the account." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--416984ce-e348-59e0-8a00-d0d86b0953ea", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:8c26ce41-66e8-48c2-9d3f-a2997b02a2c4", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:1526e66c-9282-4141-85ad-671935375283", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-09-27" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--4a774586-5634-5d58-8bdb-8c6043652c14", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:fe586a79-22a0-475c-a14a-33bf2dae3369", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:4034737c-7446-4f6d-8b82-984eb0f7b75e", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Ohio State published its account of the compromise." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--510cea15-8730-538c-8c32-d16f8966d2c2", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:d2582a47-0ecc-47fb-be07-e934f44f531d", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:471ecb90-3332-4dd2-8270-d44ddf140408", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The campaign targeted approximately 8,900 university email addresses; email controls blocked most messages. This is a target-address count, not a confirmed compromised-person count." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--671f5aa0-6bed-578e-8b47-ad275a2589ab", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:8e24dbb2-f57e-470c-baae-806acd5f2aab", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:1e44db12-c7a3-4b38-a0f1-ed11f0b31381", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-08" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--82b25209-17b8-5363-8037-94ee52453ca4", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:94b3b11b-6c7b-4935-8f09-69ab00991dbe", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:c5faa786-3afd-43f9-8ffb-c15946eb73e6", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Access used a legacy authentication route that did not require the university’s standard single sign-on." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--93da780e-5792-52ba-8f17-a49a291f8f30", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:a376acc9-dfec-40e3-9f66-43d196b39a06", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:9e8ae72f-a640-4b62-b94b-a12714209f83", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The unauthorized user uploaded a contact list and attempted phishing delivery to external recipients." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--d3e178f1-87d8-5a3e-8569-f12afbbb4a37", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:5320c508-8866-4a7d-ae0a-aac89313aa7d", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:8d2096de-c6e5-4e5e-a3d9-2d0a92878815", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Some phishing messages reached university inboxes, and affected recipients were directly notified." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--dbc5f0ef-7a7a-5738-8abf-090e3a67887e", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:45be0f81-988d-41ed-865a-1369766f4a81", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:0424611a-df6e-4a62-a55f-17ad148fc514", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-08" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--f032b4d9-a164-583d-8e49-851339fb5881", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "clm:a2b8688d-7c7d-4dab-8d61-79efd85d485e", "confidence": 100, "external_references": [ { "source_name": "Ohio State Office of Technology and Digital Innovation", "url": "https://it.osu.edu/news/2026/10/08/security-incident-involving-qualtrics-account-prompts-additional-safeguards", "external_id": "cit:8457137b-1d09-43f0-b078-20efd0631206", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:3a12873e68acff8290c3ef67bd74569be59e21a211cf7d764da1bcaee89abb3f" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Ohio State and Qualtrics were reviewing the incident and options to reduce legacy-authentication risk." } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--07b30cbe-b3fe-5350-83ab-f400f22cb270", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "evt:a07083d1-8f95-4ca7-b47a-fddc57581af4", "name": "Account disabled" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--c9824f30-d6ce-5a45-815c-cf73fded419c", "created": "2026-10-16T14:04:35.626484+00:00", "modified": "2026-10-16T14:04:35.626484+00:00", "x_ally_original_id": "evt:b5af94b9-2463-4079-b43c-980fe2c39f88", "name": "University disclosure published" } ] }