{
  "type": "bundle",
  "id": "bundle--fd7c2152-555c-50a7-885b-65dcff9b8200",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--a81996bc-c35c-5c8a-85c3-fbed7afa71bb",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "org:dff9c7fa-6798-4e82-994e-1aa8d7dfd18e",
      "name": "USForex Inc.",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--b658e48a-c8ba-5d2e-851b-9167dc9503ac",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "inc:63c66d09-755a-4c3f-975f-a826dd13fc31",
      "name": "USForex / OFX internal-files access incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--bf46bf92-d73b-51db-8f29-d404728bfe5f",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "brh:213560f4-45f2-4fff-b03c-e8fc9fe98950",
      "name": "USForex / OFX internal-files access incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--16d2f082-eef5-5b27-838c-2961316b7912",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:651aacbf-b41d-4c1d-8a3a-dc557e34f274",
      "relationship_type": "resulted-in",
      "source_ref": "incident--b658e48a-c8ba-5d2e-851b-9167dc9503ac",
      "target_ref": "x-ally-event--ab962aad-a3a3-59a9-8da9-3d831130b928",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OFX",
          "url": "https://www.ofx.com/security/incident",
          "external_id": "cit:156c5b20-cdb6-484c-8d27-9eea9381f15d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2420384eade4f666893721f92ba63299aa28b9d4b5652697af6ac3303536b7"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--419df6f0-f569-568f-8150-e18805e19795",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:bfb9f7a4-1cf7-4749-bd44-0b875aa94316",
      "relationship_type": "resulted-in",
      "source_ref": "incident--b658e48a-c8ba-5d2e-851b-9167dc9503ac",
      "target_ref": "x-ally-event--b2d8c57a-e382-526d-8530-35f5d594e5d8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OFX",
          "url": "https://www.ofx.com/security/incident",
          "external_id": "cit:d8ef710f-5bac-48d0-b507-b4d51a0f0987",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2420384eade4f666893721f92ba63299aa28b9d4b5652697af6ac3303536b7"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--670c5917-d05e-550d-812d-14ecb17db970",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:1040446b-b79e-4740-be54-c45bba0122f8",
      "relationship_type": "resulted-in",
      "source_ref": "incident--b658e48a-c8ba-5d2e-851b-9167dc9503ac",
      "target_ref": "x-ally-event--67312683-10fe-53c2-8e27-cbe1cf6c8bb7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:bdf8cac7-5db2-4b91-8ec6-8f69a1683729",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--795c1968-f609-53a8-87e8-2715727e5fb7",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:dab5a986-4f52-4d99-ab0b-2959ffb90489",
      "relationship_type": "affected-organization",
      "source_ref": "incident--b658e48a-c8ba-5d2e-851b-9167dc9503ac",
      "target_ref": "identity--a81996bc-c35c-5c8a-85c3-fbed7afa71bb",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:d4a7e99b-8342-4dcf-9d78-530074f7a000",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        },
        {
          "source_name": "California Attorney General",
          "url": "https://oag.ca.gov/ecrime/databreach/reports/sb24-631909",
          "external_id": "cit:c2f7bd16-010b-4961-8ea4-d1a4e9691a3f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:b7d9f0907cbdf6f0b8e482774db5115dc8d1871fefed2e6434efd98c959c0cec"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c54fc3f1-5c9a-5e58-8e38-641a0990a19c",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:5c010dc2-25b7-4cdd-9779-3093a6ffba13",
      "relationship_type": "resulted-in",
      "source_ref": "incident--b658e48a-c8ba-5d2e-851b-9167dc9503ac",
      "target_ref": "x-ally-event--450ac5a8-c6c0-5704-8eee-c822973b1c2e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:0822ecd8-6d81-448b-b434-196bb5e3486a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--01a5fe4f-797b-58bf-8f94-7349fccbe3a2",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:4b3c5db0-0556-4112-9262-90c57c2e58a4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:7a296c3b-c459-4abc-bec2-ac9957a57f30",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-09-29"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2825f2f2-e998-5018-89ee-14f00ba870fb",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:dde8b98a-6107-40b9-af93-edfcddb6c852",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:974bf93e-3e36-4f40-8b0b-e09844e9cb79",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-09-28"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--47fccc51-aa25-5a2b-8422-db4f5777e11a",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:4a6df986-dda0-41df-a255-94dd2427fb4f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OFX",
          "url": "https://www.ofx.com/security/incident",
          "external_id": "cit:dda9895a-6843-4798-aaa7-d69b7b507db8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2420384eade4f666893721f92ba63299aa28b9d4b5652697af6ac3303536b7"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OFX’s October 15 update said the investigation confirmed client-platform databases were not accessed, the affected files contained no copies of identity documents, and none of the accessed data could be used to make payments on the OFX platform. Services continued normally; no unauthorized client account or funds access had been identified."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--97742e97-0d0a-5be4-8057-84f0ba533ee3",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:1e37bbc7-f5de-4237-bc70-7f050efb531b",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:730b2b59-4a68-4bd3-bf28-7bbc1b377fc7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-09-28"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--98f1a982-6822-58e6-8398-1069e9bf0eea",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:66417f85-c706-4e7f-9539-42995dacdd50",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OFX",
          "url": "https://www.ofx.com/security/incident",
          "external_id": "cit:9432efcd-cbe4-4151-9177-042a816a743f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2420384eade4f666893721f92ba63299aa28b9d4b5652697af6ac3303536b7"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-15"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a79c3584-26cb-589f-8877-bea3b808584d",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:6a35b5a3-c66e-40e0-9548-93066516be2c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:9140559b-4ab5-43d4-8e9d-56db152d6467",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OFX said the affected files were held separately from its underlying client platform, which was not accessed. It had not identified unauthorized access to the recipient’s OFX account or funds."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c0272a29-87b1-5906-87fb-abd9ad0eff54",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:04e9682a-3f14-4273-9ba9-2e1492258769",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:83492533-92f8-48e4-bb3e-6aa93208d58d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OFX said an unknown party accessed files used for processing, reporting and internal analysis on September 28, 2026; it detected the incident on September 29 and began containment."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c2b3ba35-1c74-531e-8c8b-b2443475ffbd",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:cb879a95-b233-435f-800a-078effae8037",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OFX",
          "url": "https://www.ofx.com/security/incident",
          "external_id": "cit:1ee3d665-248d-444b-9c46-3c3e392fc2a6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2420384eade4f666893721f92ba63299aa28b9d4b5652697af6ac3303536b7"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The retained October 4 public update described unauthorized access to some client data and apparent data about non-client contacts such as job applicants. It does not give an affected-person total."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--cef18ded-62c6-589a-84d1-9671ca4642ad",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:98a98c98-22bd-415e-9d46-acc20d721557",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:7fe66b8d-c1d7-43c6-9899-57a77e20ac3a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The affected files contained names and/or usernames plus postal addresses, email addresses and telephone numbers. The sample does not establish the global affected population or every customer’s fields."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d8afa3df-27fa-57a7-83b7-ff410bd908a9",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:7e9a1301-2a30-46c7-8ec4-005991a95401",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "OFX",
          "url": "https://www.ofx.com/security/incident",
          "external_id": "cit:7c4c4eb1-0f7a-4120-900c-5c8d504f8f5f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1a2420384eade4f666893721f92ba63299aa28b9d4b5652697af6ac3303536b7"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-04"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e67fbf2d-46fe-5fa1-8023-751dc986a9a5",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:77c794a8-cc6f-4e56-9228-838f57c6ecce",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:ef9f0d5b-0902-4d68-93cb-90883ca70214",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-09-29"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f25805f9-6bd0-59f0-8a93-a1dc3452170a",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "clm:2d3ff1a0-f54e-44b6-a8cb-4c2f1d6c3156",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "USForex Inc.",
          "url": "https://oag.ca.gov/system/files/Client%20Comms%20-%20P3%20Consumer%20%5BUS%5D%2020261023_Redacted.pdf",
          "external_id": "cit:eed5520e-e836-445f-b690-6234de2864c6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:1d2fb4d34bdafd21324935e8ba2567d348bab70149407717b9cc478a38e5bd3d"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "OFX continued monitoring accounts and notifying relevant regulators. It warned about impersonation, advised passkeys and two-factor authentication, and provided incident support."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--450ac5a8-c6c0-5704-8eee-c822973b1c2e",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "evt:414ca627-cbf0-496c-9623-934ff72c7e19",
      "name": "Incident identified"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--67312683-10fe-53c2-8e27-cbe1cf6c8bb7",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "evt:7385c012-ba4f-4e6e-ab6d-5754d5d50b47",
      "name": "Internal files accessed"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--ab962aad-a3a3-59a9-8da9-3d831130b928",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "evt:dc8ebe37-9dc8-427d-85fa-168d58930707",
      "name": "OFX confirms platform-database boundary"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--b2d8c57a-e382-526d-8530-35f5d594e5d8",
      "created": "2026-10-28T14:20:22.967350+00:00",
      "modified": "2026-10-28T14:20:22.967350+00:00",
      "x_ally_original_id": "evt:63777d63-f731-4c28-bd6c-e2c71bc2579d",
      "name": "OFX publishes retained public update"
    }
  ]
}