{
  "type": "bundle",
  "id": "bundle--907b62d1-5d36-5365-8886-944d51b942ec",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--e920b129-fed5-5bfd-89f0-a27b3cf626a9",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:cca915cc-678b-57d1-a713-eaef59109151",
      "name": "Shell",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--8a0b77e2-ebad-51dc-85bb-e2151f1869f3",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:cc58f2f1-48ef-5589-ad94-e188940bbc80",
      "name": "Shell security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--cebc87b4-65a0-55ac-8888-94fe5cc981ac",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:2aafee0d-8721-599d-bbed-e4af3ffa287b",
      "name": "Shell security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e605054e-c8ce-5091-86c9-cd846789ccc1",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:fec1755c-eae8-5b0a-84fb-ed8f0d9f9c16",
      "relationship_type": "affected-organization",
      "source_ref": "incident--cebc87b4-65a0-55ac-8888-94fe5cc981ac",
      "target_ref": "identity--e920b129-fed5-5bfd-89f0-a27b3cf626a9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Recorded Future News",
          "url": "https://therecord.media/shell-impacted-in-clop-ransomware-attack",
          "external_id": "cit:007d363c-eba8-50b8-b3c1-066ea58a5590",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fc51c4f099655012ff280537f6fa20b668e3082dcad80e7ec30960f25925617b"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2aea03c0-d780-50b3-8a37-8b0191272e22",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:e1904bbe-729d-530e-9570-98ce9b3434ec",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Recorded Future News",
          "url": "https://therecord.media/shell-impacted-in-clop-ransomware-attack",
          "external_id": "cit:21edb354-a496-5435-8864-f47ae55b748f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2ac8f7a6ba3c69c315fe83dbde8ad8d471ef25d0c5faf91d92fc54819103b6c8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2023-06-15"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--42a77dcf-2722-5dda-85cc-0f2f2e8877a9",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:bda7bd82-bb34-57f1-b26b-8c924f9d6dab",
      "confidence": 88,
      "external_references": [
        {
          "source_name": "Recorded Future News",
          "url": "https://therecord.media/shell-impacted-in-clop-ransomware-attack",
          "external_id": "cit:db1532ea-71a1-5960-99da-815e33ac9c5e",
          "description": "Ofcom said “a limited amount of information” was downloaded in the attack, although some of it was confidential and related to the companies it regulates, along with the personal data of 412 Ofcom employees.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2ac8f7a6ba3c69c315fe83dbde8ad8d471ef25d0c5faf91d92fc54819103b6c8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Employee and business data stolen."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--89bbc471-54fd-5662-80fe-55f964ca7fee",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:7a815cec-be72-53d8-80bf-51e317c33a4a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Recorded Future News",
          "url": "https://therecord.media/shell-impacted-in-clop-ransomware-attack",
          "external_id": "cit:b99006b2-1d9a-50d4-a875-fbe7060c435a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:fc51c4f099655012ff280537f6fa20b668e3082dcad80e7ec30960f25925617b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the shell security incident involving Shell."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d8ef6deb-7489-5d7d-889d-174608b1297d",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:c230ee24-9660-5694-b559-60f9a21d01e2",
      "confidence": 82,
      "external_references": [
        {
          "source_name": "Recorded Future News",
          "url": "https://therecord.media/shell-impacted-in-clop-ransomware-attack",
          "external_id": "cit:20d04a31-b7cb-5502-9fcd-0ee7955c327e",
          "description": "Shell confirmed on Thursday it had been impacted by the Clop ransomware gang’s breach of the MOVEit file transfer tool after the group listed the British oil and gas multinational on its extortion site.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2ac8f7a6ba3c69c315fe83dbde8ad8d471ef25d0c5faf91d92fc54819103b6c8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "MOVEit/Cl0p."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--e1649478-660e-5c4d-84a2-51908b9df737",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:f7ea2313-d24f-51ac-b1e8-9616e9e0fe8d",
      "name": "Documented public update"
    }
  ]
}