{
  "type": "bundle",
  "id": "bundle--da1fa650-d947-58f5-8b07-834febe2ee98",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--980eac75-6885-5f0a-874b-bd410d4f8f6a",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:c114da26-ca5f-5391-be60-263253b8532b",
      "name": "Royal Mail",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--aaa11c05-5476-5557-8f0c-29b571e8e083",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:cc993825-8536-5f62-b5a8-534ac0b4b3fd",
      "name": "Royal Mail (UK) security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--c296b5f0-22d7-533d-8ecf-f992320946e2",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:92587c41-7248-59b0-85a4-8acc3abdd9e3",
      "name": "Royal Mail (UK) security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0cea232b-6c4f-51bd-8955-ee640183b392",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:0421fe26-b240-55f1-b306-94e42712e742",
      "relationship_type": "affected-organization",
      "source_ref": "incident--aaa11c05-5476-5557-8f0c-29b571e8e083",
      "target_ref": "identity--980eac75-6885-5f0a-874b-bd410d4f8f6a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UK Home Office",
          "url": "https://data.parliament.uk/DepositedPapers/Files/DEP2025-0013/Ransomware_Consultation_Document-January_2025.pdf",
          "external_id": "cit:7f7ebc5c-e9c8-504c-9ab5-b425614d0812",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:47ed255ae0e65902f29de3d84002e08a778199cf6dd811483cd1480cebc7d36f"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6b5bfdf4-8e57-56d4-8ac3-cfb15eec88f2",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:47a31238-bfbe-5eb1-8c01-048a88758290",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "UK Home Office",
          "url": "https://data.parliament.uk/DepositedPapers/Files/DEP2025-0013/Ransomware_Consultation_Document-January_2025.pdf",
          "external_id": "cit:c195d1ca-e0be-5101-a31b-bbdc969bf1b7",
          "description": "Royal Mail ransomware attack (January 2023) – domestic and international operations were affected for several weeks when hit by the Russian cyber- crime group LockBit.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:47ed255ae0e65902f29de3d84002e08a778199cf6dd811483cd1480cebc7d36f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "LockBit."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9bee9883-f4a4-5b2f-8ecd-259a06e2851a",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:fb227136-03cc-5dbf-a4d1-a495201ac728",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "UK Home Office",
          "url": "https://data.parliament.uk/DepositedPapers/Files/DEP2025-0013/Ransomware_Consultation_Document-January_2025.pdf",
          "external_id": "cit:cb781fb4-05f2-53b7-8a9c-1c33de232c81",
          "description": "A ransom is demanded (normally payment of cryptocurrency) from the victim to regain access to the system(s); for data to be restored; or for data not to be published on criminal-operated data leak websites.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:47ed255ae0e65902f29de3d84002e08a778199cf6dd811483cd1480cebc7d36f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes system restoration or operational recovery work."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d3d51a27-b031-56f9-8be4-af83e5acce47",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:b0d26c2d-cfea-5703-b433-8d8074b0f408",
      "confidence": 88,
      "external_references": [
        {
          "source_name": "UK Home Office",
          "url": "https://data.parliament.uk/DepositedPapers/Files/DEP2025-0013/Ransomware_Consultation_Document-January_2025.pdf",
          "external_id": "cit:862bc2c1-67b7-562f-afed-c89fea1dcd1e",
          "description": "An extensive investigation by the National Crime Agency during that period helped map out the history and reach of Evil Corp’s criminality and contributed directly to the decision by US authorities in 2019 to indict and sanction the head of Evil Corp, Maksim Yakubets, and several other members.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:47ed255ae0e65902f29de3d84002e08a778199cf6dd811483cd1480cebc7d36f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Tens of millions £."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f5c9dcca-a45c-5951-883c-58fccc7cf805",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:a13954bd-df15-5277-bf5a-34d2ade204b2",
      "confidence": 83,
      "external_references": [
        {
          "source_name": "UK Home Office",
          "url": "https://data.parliament.uk/DepositedPapers/Files/DEP2025-0013/Ransomware_Consultation_Document-January_2025.pdf",
          "external_id": "cit:f331ee13-c892-5aec-92bf-28a6a7b470f9",
          "description": "In May 2024, one of the previously anonymous leaders of the LockBit network, Dmitry Khoroshev, was publicly unmasked and sanctioned by the UK, US and Australia, with the FBI offering a $10m reward for information leading to his arrest and/or conviction.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:47ed255ae0e65902f29de3d84002e08a778199cf6dd811483cd1480cebc7d36f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "International shipping halted for weeks; £10M demand refused."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--fb359cb7-3fdf-5b73-86f9-ccc04a89fe01",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:4d494fab-b2ff-5bf5-8aca-e1e348ec9668",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "UK Home Office",
          "url": "https://data.parliament.uk/DepositedPapers/Files/DEP2025-0013/Ransomware_Consultation_Document-January_2025.pdf",
          "external_id": "cit:c8cd94e7-91fa-5670-8229-5f809fb096fd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:47ed255ae0e65902f29de3d84002e08a778199cf6dd811483cd1480cebc7d36f"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the royal mail (uk) security incident involving Royal Mail."
      }
    }
  ]
}