{
  "type": "bundle",
  "id": "bundle--c994b8f1-5b05-59aa-8c98-905f025ce6ff",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--96036d2e-e31f-54f5-8588-0b484af670f1",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:7d273791-1f2e-58f9-8e6e-bb9b6f31b99d",
      "name": "X",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--a77cd069-1a91-5977-8c9c-c344ad88dc96",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:93a32c9a-4ef9-5603-a963-3609faf99277",
      "name": "Twitter API data exposure"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--ee0145a4-c429-5a4d-806e-3261a19810b7",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:b7e59404-27ab-543e-aad6-3c78c45a4cbf",
      "name": "Twitter API data exposure"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01340ce9-3531-505d-831d-6fb4d063a16d",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:4ef74b6d-8874-517b-a829-55d9389eca73",
      "relationship_type": "affected-organization",
      "source_ref": "incident--ee0145a4-c429-5a4d-806e-3261a19810b7",
      "target_ref": "identity--96036d2e-e31f-54f5-8588-0b484af670f1",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "X",
          "url": "https://privacy.x.com/en/blog/2023/update-about-an-alleged-incident-regarding-twitter-user-data-being-sold-online",
          "external_id": "cit:456d9d25-d211-5787-858e-cbe71882d475",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:58b44195c218f4585b1f10e6fe20ae628a7dfe00e0809f6306b310bfeb111a69"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--24e17007-1fee-5592-80a4-85e778bb11bd",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:4855e953-3205-5cb6-9fc3-0173f25029a5",
      "confidence": 89,
      "external_references": [
        {
          "source_name": "X",
          "url": "https://privacy.x.com/en/blog/2023/update-about-an-alleged-incident-regarding-twitter-user-data-being-sold-online",
          "external_id": "cit:88364ccb-1a03-55e0-a468-e7d438b15975",
          "description": "As a result of the vulnerability, if someone submitted an email address or phone number to X's systems, X's systems would tell the person what X account the submitted email addresses or phone number was associated with, if any.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:faf6065fbdcf763da4e94591369764810dd75c19df8422797aee9b3adce976c4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "API vulnerability allowing phone/email-to-account lookup."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b20857a5-bd4e-5ee6-8d7d-6bd5ba64f466",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:a750cb79-08a5-5ebd-864c-1fdf0954f57a",
      "confidence": 83,
      "external_references": [
        {
          "source_name": "X",
          "url": "https://privacy.x.com/en/blog/2023/update-about-an-alleged-incident-regarding-twitter-user-data-being-sold-online",
          "external_id": "cit:259de8fe-0d44-564a-8569-8addbcecca8e",
          "description": "Recently, in January 2023, a similar attempt to sell data from 200 million X-associated accounts was reported in the media.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:faf6065fbdcf763da4e94591369764810dd75c19df8422797aee9b3adce976c4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "200M+ account records scraped and later leaked."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d2f5d23b-7077-5af0-8d68-9c2dc8040ca2",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:8cfcd484-e025-5785-96e2-d24466bfd3bd",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "X",
          "url": "https://privacy.x.com/en/blog/2023/update-about-an-alleged-incident-regarding-twitter-user-data-being-sold-online",
          "external_id": "cit:2bdd34c3-f321-5abc-8ef0-be7be5bd5468",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:58b44195c218f4585b1f10e6fe20ae628a7dfe00e0809f6306b310bfeb111a69"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the twitter api data exposure involving X."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e7c4fabb-0b50-507c-8870-01d89259355b",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:2888f67c-89ce-5732-88d7-dc6525584d76",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "X",
          "url": "https://privacy.x.com/en/blog/2023/update-about-an-alleged-incident-regarding-twitter-user-data-being-sold-online",
          "external_id": "cit:f2c4cf7f-f493-5d56-ae65-9a0af2eaa357",
          "description": "- 5.4 million user accounts reported in November were found to be the same as those exposed in August 2022. - 400 million instances of user data in the second alleged breach could not be correlated with the previously reported incident, nor with any new incident. - 200 million dataset could not be correlated with the previously reported incident or any data originating from an exploitation of X systems. - Both datasets were the same, though the second one had the duplicated entries removed. - None of the datasets analyzed contained passwords or information that could lead to passwords being compromised.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:faf6065fbdcf763da4e94591369764810dd75c19df8422797aee9b3adce976c4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source describes containment action intended to limit further access or disruption."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--eccceca1-b2f9-5eab-8a7f-514bc53f6f4a",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:d3c480f9-8d88-5211-9d6f-dad6f4366c33",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1190/"
      }
    }
  ]
}