{
  "type": "bundle",
  "id": "bundle--1f4ae14e-e8f1-502d-8e90-45080b62607d",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--5328c25b-786b-59da-8860-0926e3272925",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:c3e3295d-e528-52df-8c6a-12a1c233041b",
      "name": "US Department of Energy",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--119acb8f-5049-5df1-8466-cf49d6b127f6",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:c8c25540-2caa-5203-9aff-83bddfe4a373",
      "name": "US Department of Energy security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--79f1cc27-57f1-5978-8387-0d8f101303f2",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:fbbdd1fe-2989-558f-a8c7-7507c4e45e6c",
      "name": "US Department of Energy security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5718bf49-9b32-539b-80b7-18e91c4b3bac",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:1c0b8af5-8776-5962-8932-c8cebe5cd25d",
      "relationship_type": "affected-organization",
      "source_ref": "incident--79f1cc27-57f1-5978-8387-0d8f101303f2",
      "target_ref": "identity--5328c25b-786b-59da-8860-0926e3272925",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CyberScoop",
          "url": "https://cyberscoop.com/energy-department-cl0p-moveit-cisa/",
          "external_id": "cit:df1b8a4f-cb24-5801-8c5a-5588bbb95c17",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7e60d31314a3a20539377cb5d08c3d73164be15db7d644df2d19a9843675ffb4"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0da3effd-a7ce-5ea3-851b-2ea5344dddca",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:dae90347-7acd-587a-9adf-c05ab2294650",
      "confidence": 90,
      "external_references": [
        {
          "source_name": "CyberScoop",
          "url": "https://cyberscoop.com/energy-department-cl0p-moveit-cisa/",
          "external_id": "cit:197a46a1-8d25-5ae6-872b-68d2e7ebca3e",
          "description": "“The Department has notified Congress and is working with law enforcement, CISA, and the affected entities to investigate the incident and mitigate impacts from the breach,” the spokesperson said.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7e60d31314a3a20539377cb5d08c3d73164be15db7d644df2d19a9843675ffb4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained source reports coordination with law enforcement as part of the incident response."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--27ac127c-7d46-579a-8bc2-ed66224e9454",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:50aca175-fa84-58b6-83d0-85a70fb8aed8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CyberScoop",
          "url": "https://cyberscoop.com/energy-department-cl0p-moveit-cisa/",
          "external_id": "cit:c6a0069e-05ea-5e35-8cb1-0cc405255a2b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7e60d31314a3a20539377cb5d08c3d73164be15db7d644df2d19a9843675ffb4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the us department of energy security incident involving US Department of Energy."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a60572ad-b6a6-5410-8e03-bc5966ab40d2",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:0ae8eba8-eebf-51dc-b07b-e9165a4844e0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "CyberScoop",
          "url": "https://cyberscoop.com/energy-department-cl0p-moveit-cisa/",
          "external_id": "cit:b5f47c84-4185-5b5a-b75b-28e467053d36",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7e60d31314a3a20539377cb5d08c3d73164be15db7d644df2d19a9843675ffb4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2023-06-15"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--aaa90fcb-5c38-5058-880f-1d9270b55059",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:e303713d-dd7c-5a20-bb14-2af37939eeae",
      "confidence": 88,
      "external_references": [
        {
          "source_name": "CyberScoop",
          "url": "https://cyberscoop.com/energy-department-cl0p-moveit-cisa/",
          "external_id": "cit:4a2d9253-d6fe-5d23-8c3a-e205dab4b2d6",
          "description": "A Department of Energy spokesperson told CyberScoop on Thursday afternoon that “upon learning that records from two DOE entities were compromised in the global cyberattack on the file-sharing software MOVEit Transfer, DOE took immediate steps to prevent further exposure to the vulnerability and notified the Cybersecurity and Infrastructure Security Agency (CISA).”",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7e60d31314a3a20539377cb5d08c3d73164be15db7d644df2d19a9843675ffb4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Data from DOE entities exposed."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ebe26a58-2e70-5299-8708-2a65f74fa956",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:2597e396-e4c0-5bbd-9358-aadb325a3aaa",
      "confidence": 95,
      "external_references": [
        {
          "source_name": "CyberScoop",
          "url": "https://cyberscoop.com/energy-department-cl0p-moveit-cisa/",
          "external_id": "cit:2a283593-af05-59f5-9a68-b9ec1d10587c",
          "description": "The group added 27 victim organizations to its leak page since June 14, according to data collected by eCrime.ch, however it’s not clear whether all of those entities were MOVEit users or that they were targeted by CL0P in separate extortion attacks.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7e60d31314a3a20539377cb5d08c3d73164be15db7d644df2d19a9843675ffb4"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "MOVEit/Cl0p."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--439281a6-7825-5fbd-8bc9-fc63857b1e82",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:05012cc2-8ee5-577b-90c9-308719a4aa91",
      "name": "Documented public update"
    }
  ]
}