{
  "type": "bundle",
  "id": "bundle--ad909a1e-6744-5700-866f-2c3325842d24",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--dbcbd452-6940-5ea7-8696-be85ce87aeda",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:548f1bcd-20c6-5d53-abcc-93bcfd91bfa7",
      "name": "Santander",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--1411c1a9-66b1-50a9-8e03-3b0696a6c9bf",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:7082e4f1-714f-506d-a7d6-864044c59d9b",
      "name": "Santander Bank security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--c48c5680-8702-59ad-886e-3dce96923ae2",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:3bc10cf2-fabd-5e7e-9ce6-8834a2dd75fb",
      "name": "Santander Bank security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4e15c71e-f1c0-5989-8d16-79db11851b30",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:5080abd0-e28a-5412-a160-722031042b97",
      "relationship_type": "affected-organization",
      "source_ref": "incident--1411c1a9-66b1-50a9-8e03-3b0696a6c9bf",
      "target_ref": "identity--dbcbd452-6940-5ea7-8696-be85ce87aeda",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Santander",
          "url": "https://www.santander.com/en/stories/statement",
          "external_id": "cit:4a9494b6-4bfc-5a78-a370-a18f2039dddd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:da2d950cff126c3b06ed41fd1620381d099195620fa1afbe0528154c215b27f8"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8091561b-9727-532d-86d1-a899d8c9566b",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:674727d4-fec0-5096-8cef-d3f75cd04a66",
      "confidence": 86,
      "external_references": [
        {
          "source_name": "Santander",
          "url": "https://www.santander.com/en/stories/statement",
          "external_id": "cit:249d7327-f258-5045-8e4f-da79f2b53bf3",
          "description": "We immediately implemented measures to contain the incident, including blocking the compromised access to the database and establishing additional fraud prevention controls to protect affected customers.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:92b359741086b79f2c00020de1b4d92c209825cc5a7de79fc0a368518184184c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Employee and customer data across multiple countries exposed."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9294103a-b761-5d1a-8107-4b36b3bbd863",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:353b16af-63e4-5138-9e4e-c7f6e5f378b4",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1078/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a09f88a1-83ea-5a24-8115-8040991feaa9",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:5b742d4f-f927-54cb-b872-e04dcba99701",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Santander",
          "url": "https://www.santander.com/en/stories/statement",
          "external_id": "cit:f847f5a9-b642-5243-91d6-ae33059bf2c0",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:da2d950cff126c3b06ed41fd1620381d099195620fa1afbe0528154c215b27f8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the santander bank security incident involving Santander."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d9630e43-1a30-527b-81db-c287c49c320c",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:fe00465c-fed7-5b5f-aee7-f85bb31a77cf",
      "confidence": 84,
      "external_references": [
        {
          "source_name": "Santander",
          "url": "https://www.santander.com/en/stories/statement",
          "external_id": "cit:fa5445fa-07ab-51f2-b1f7-95b096b17cfb",
          "description": "No transactional data, nor any credentials that would allow transactions to take place on accounts are contained in the database, including online banking details and passwords.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:92b359741086b79f2c00020de1b4d92c209825cc5a7de79fc0a368518184184c"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Stolen credentials were used against a Snowflake customer account that did not enforce MFA."
      }
    }
  ]
}