{
  "type": "bundle",
  "id": "bundle--39704d0f-0f0e-5c58-8286-61f39e02063f",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--2d9725e8-f7d8-543f-894c-952100cd506f",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:5cbec180-ea4f-5805-9ca9-108ba43846f2",
      "name": "Retool",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--d1afc47b-277f-5ac4-88da-c4dd3b3f95e4",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:b57641ff-7090-50be-b572-ad5c6b62f4f8",
      "name": "Retool security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--fb94707e-cfb3-568e-80fe-a123e32211a7",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:932c2c98-661a-5db1-b671-fe6cd7e6b6ba",
      "name": "Retool security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ec4a89f-4824-5347-8438-ecc6baaec05f",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:07fe56b2-3f1b-5628-a6d8-96659447226e",
      "relationship_type": "affected-organization",
      "source_ref": "incident--d1afc47b-277f-5ac4-88da-c4dd3b3f95e4",
      "target_ref": "identity--2d9725e8-f7d8-543f-894c-952100cd506f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Retool",
          "url": "https://retool.com/blog/mfa-isnt-mfa",
          "external_id": "cit:5312c0aa-0fd0-5f61-854b-2e80936ce6d0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:de28343361dc78f86eb1675f4c0ab1b0a2b91909ca19cba0ce64e84a8e54c808"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--13fce4fb-8466-5808-8d72-6e9dca05d169",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:8e89916c-7328-5b09-ac87-0057fa03d29b",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Retool",
          "url": "https://retool.com/blog/mfa-isnt-mfa",
          "external_id": "cit:88e52ed1-b52f-5b4c-a205-252debd4fe5e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:de28343361dc78f86eb1675f4c0ab1b0a2b91909ca19cba0ce64e84a8e54c808"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the retool security incident involving Retool."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1f81c956-9e42-50ed-8887-f4f2c21a009b",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:f0bccbff-66e4-5d79-baa1-e88bf36baffd",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "Retool",
          "url": "https://retool.com/blog/mfa-isnt-mfa",
          "external_id": "cit:71c6d062-cf39-5803-9b94-0cec7ca45e42",
          "description": "After learning of the attack, we immediately revoked all internal authenticated sessions (Okta, GSuite, etc) for employees, locked down access to the affected accounts, notified the affected customers, and restored their accounts to their original state (with original email addresses), reverting the 27 account takeovers.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:e6d96d3494ae4e02fcee8fe5dba459a6245f8123139a19ee89e382f403de5933"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes system restoration or operational recovery work."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4a0e007e-c6ed-5fc5-8799-809da73644ed",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:9abdeac7-d66d-5264-aed1-939eca1f1ab1",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1566/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--880f966b-28aa-58e6-8a75-33e7b801cfad",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:30841803-2625-58af-8d63-e8d5e75d9d40",
      "confidence": 86,
      "external_references": [
        {
          "source_name": "Retool",
          "url": "https://retool.com/blog/mfa-isnt-mfa",
          "external_id": "cit:8d76bbf8-8208-5cde-ac14-ea891d6b9a8a",
          "description": "The caller claimed to be one of the members of the IT team, and deepfaked our employee’s actual voice.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:e6d96d3494ae4e02fcee8fe5dba459a6245f8123139a19ee89e382f403de5933"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "SMS phishing + deepfake voice call impersonating IT + MFA fatigue."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--dd09581b-a4b5-55a5-8353-432ae556bca4",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:9e800ca9-8491-5547-b92f-e5e75a5963ce",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1621/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f02922a6-fcb0-5b29-8a9d-0b71839c8e33",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:abb6e84d-887c-51ed-93f1-9b2febaf4ca2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Retool",
          "url": "https://retool.com/blog/mfa-isnt-mfa",
          "external_id": "cit:96717e17-8477-5c26-b9c9-57e2540d8aa8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:e6d96d3494ae4e02fcee8fe5dba459a6245f8123139a19ee89e382f403de5933"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2023-09-13"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--09681a46-a524-5a0b-88a1-af65ba1097ad",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:988ab06c-d039-5f1a-973c-d4882c77a57c",
      "name": "Documented public update"
    }
  ]
}