{
  "type": "bundle",
  "id": "bundle--c2597c99-d7dd-5620-89bc-4bdc64062146",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--2a155787-c661-5eb1-8971-288c24e5b992",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:5929a8d1-0040-5eca-9be7-c30dd99e13fd",
      "name": "Rackspace",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--906d92ac-9429-5911-809c-c2f47dea205a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:9337ee61-b8f5-57b9-be50-9f44efcb31cd",
      "name": "Rackspace security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--cb5c15f3-ad9e-59b9-84cd-449c7f26d97e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:0e0cee1f-f415-5736-9993-e9122a9be2cc",
      "name": "Rackspace security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1f94495b-02bc-59e5-8a8c-c8d72211e5df",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:6b95ee1d-7ad0-5155-a59e-193bf43cfb4e",
      "relationship_type": "affected-organization",
      "source_ref": "incident--906d92ac-9429-5911-809c-c2f47dea205a",
      "target_ref": "identity--2a155787-c661-5eb1-8971-288c24e5b992",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/1810019/000181001923000034/rxt-20221231.htm",
          "external_id": "cit:034d1a74-5f83-5aef-ac33-caa3e87891f8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:32c6f95429a6b0f12f63d0237b2dd568f0e44cd3146a91c8b5d01e599e18fdd6"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0e81c396-a140-53c9-8a01-4d80df8ba3ec",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:8c0abe34-964d-5d76-8c6a-ada022fe6f36",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/1810019/000181001923000034/rxt-20221231.htm",
          "external_id": "cit:a8cd25ff-3c04-520e-a3df-c23df8123406",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:32c6f95429a6b0f12f63d0237b2dd568f0e44cd3146a91c8b5d01e599e18fdd6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the rackspace security incident involving Rackspace."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5ea3f220-c98f-5b2d-88ff-7fe163fcd1ee",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:b83537cc-8d71-5b05-8bbb-aba69c5a64ab",
      "confidence": 86,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/1810019/000181001923000034/rxt-20221231.htm",
          "external_id": "cit:62f6cc42-2ea6-5270-bbc4-7d4920885254",
          "description": "Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:32c6f95429a6b0f12f63d0237b2dd568f0e44cd3146a91c8b5d01e599e18fdd6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Play ransomware; ProxyNotShell Exchange zero-day."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ab558817-bb55-51ab-840e-5abad6574fa8",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:3f465b3d-7e7b-5a05-81b3-16e461067287",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/1810019/000181001923000034/rxt-20221231.htm",
          "external_id": "cit:132f899b-9678-5307-8776-f2e4c426258f",
          "description": "Following discovery of the incident, we engaged an industry-leading global cybersecurity firm to help investigate the incident and remediate as necessary.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:32c6f95429a6b0f12f63d0237b2dd568f0e44cd3146a91c8b5d01e599e18fdd6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes a forensic or specialist investigation of the incident."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c01e664e-48cc-5688-857e-b8adf6e84407",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:34c7b372-7ef9-5ab8-8c9b-0d9398661ee3",
      "confidence": 88,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/1810019/000181001923000034/rxt-20221231.htm",
          "external_id": "cit:7ec4d0f5-3507-5387-9bc4-7458a7be61c2",
          "description": "Like many companies, we have experienced these attacks, including a ransomware incident that caused service disruptions for our Hosted Exchange customers, as announced on December 6, 2022 and again on December 9, 2022.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:32c6f95429a6b0f12f63d0237b2dd568f0e44cd3146a91c8b5d01e599e18fdd6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Hosted Exchange email outage for thousands of customers."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cd7d7b2b-3166-52fb-8aba-3d809199a387",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:f0b205ec-1cec-526b-97a1-389e9728915a",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "U.S. Securities and Exchange Commission",
          "url": "https://www.sec.gov/Archives/edgar/data/1810019/000181001923000034/rxt-20221231.htm",
          "external_id": "cit:99d139a3-33e3-5635-9543-875306cca6a5",
          "description": "The firm confirmed that the incident was quickly contained and limited solely to the Hosted Exchange email business.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:32c6f95429a6b0f12f63d0237b2dd568f0e44cd3146a91c8b5d01e599e18fdd6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes containment action intended to limit further access or disruption."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cda5b078-48f3-5682-8b57-df9fc3232d90",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:79d64390-c180-5445-bfd6-d691d32fdf88",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1190/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ee0a052a-d3ae-52a6-8902-fc8d3ca945d8",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:25892b56-6ce0-5ae7-8dc7-fa265ba228e1",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1486/"
      }
    }
  ]
}