{ "type": "bundle", "id": "bundle--98ce8cbd-5e92-5f05-8971-b3e03a0b841d", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--ad66d8ff-e800-538c-8869-76aa0279cf7a", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "org:7ddb1340-d6ea-4070-acb3-149e65ea9db3", "name": "Vanguard Group Inc.", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--1f21ba32-b83a-5e2c-8f04-fb4c4ea8120a", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "inc:f5032965-bfc9-4d0f-9501-77ee880fee00", "name": "Vanguard cloud-application intrusion" }, { "type": "incident", "spec_version": "2.1", "id": "incident--c8ebb443-ac67-567d-8a2d-20a1c6c0e310", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "brh:0be40a13-34af-4b09-840b-2ac96a622624", "name": "Vanguard cloud-application intrusion" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c919c15-5c0e-5b86-8f24-d161b56908ff", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:6e6fabef-dec2-43a8-ad44-29a50b94ba3c", "relationship_type": "resulted-in", "source_ref": "incident--1f21ba32-b83a-5e2c-8f04-fb4c4ea8120a", "target_ref": "x-ally-event--5aedc62c-63fd-58b8-832c-5792f8ad6e71", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:1a022f5f-13ef-47d6-b373-d02bcb520b81", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3a41bb3b-3598-5cc5-82e9-4bfeb087d090", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:88e33dec-424c-4c57-abbb-f6285de69042", "relationship_type": "affected-organization", "source_ref": "incident--1f21ba32-b83a-5e2c-8f04-fb4c4ea8120a", "target_ref": "identity--ad66d8ff-e800-538c-8869-76aa0279cf7a", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:f61c5ff2-8019-4875-9084-91697e005b52", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6b0b2864-d9d6-58ea-8d8c-6a0cb299b04d", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:d079f8e7-4307-4583-b5f2-f92cb1b1bfce", "relationship_type": "resulted-in", "source_ref": "incident--1f21ba32-b83a-5e2c-8f04-fb4c4ea8120a", "target_ref": "x-ally-event--0c3d99bd-a425-5bed-86ca-b9491ab5f67d", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:bda79257-cfe6-4c84-9f32-0cf74425c760", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--0d28e655-7415-533c-8b71-dfef3c6b3e7a", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:f0be7e96-d9b3-4a78-97c9-8bcb1b890a3a", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:753dd295-180e-48de-9a5c-642786c39ac2", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Vanguard said client accounts were not accessed and services were not disrupted. It found no evidence of access to its recordkeeping or money-movement systems." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--36801bc3-2aaa-55b8-8696-62e4de292eec", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:7501b80d-ff8f-43b5-bf8e-e0907c1e76b3", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:9ecc9dcd-f0d3-42c3-9528-7423ec4ee252", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Some accessed files held client personal information. Individual data fields and the impact-determination date are placeholders in the public template; no total affected population is stated." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--69dd6b24-2691-5abc-8b65-b7afd739c5a8", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:692da5e9-69d8-407d-b613-eaedf2e5e058", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:99b7723a-7acb-473e-abaa-ea872da9cee2", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Vanguard contained the activity and reported no evidence of ongoing unauthorized access, malware or ransomware associated with this incident." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--81bd4f1d-284e-539c-8c7f-6e291aad7d62", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:5d6a0420-fa7e-4687-add4-782edccfe93f", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:a8554dea-d5c9-4986-a213-6e69cb189c4d", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Vanguard described social engineering during July 29–31, 2026: an imposter deceived an employee into providing access to corporate accounts, allowing access to files in a limited set of cloud applications such as Microsoft365." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--81f82e95-de48-53e5-8697-8b54278402f6", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:a2ba0786-b7c8-4922-8c84-07120db73538", "confidence": 100, "external_references": [], "x_ally_claim_object": { "kind": "iri", "value": "https://attack.mitre.org/techniques/T1078/" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--98dc5166-2d7d-50f3-87ab-095ce2142246", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:06837e63-a5d0-4688-b4e3-d6e04d9c239a", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:9bf11a3b-a422-4a8f-8a32-76c3d78b076d", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-07-29" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--a0faec79-9aa7-56b4-833a-e17ba57e1026", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:d14a5c73-90b6-4dc1-a744-e429291ada41", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:ed0eea0f-564b-4a17-94cd-cba5b257df5c", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-07-29" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--a9f1f7fb-e281-53f1-806f-a37066255c6c", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:7b307405-d45d-495e-a26b-2f9d2be11124", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:7ae4aba3-a1fb-412a-ada7-7e66df6d4a01", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-07-31" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--c168c17e-5dc1-505d-8d2d-8e6e58215d45", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:94195eb0-367f-42e0-add1-7a03964f5da3", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:681639a8-64d9-4acf-8365-0b527f11ffc0", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-07-31" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--c5c62359-a3b6-5014-88d7-ddaaefb88f00", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "clm:f1d5d0e8-2d20-4c3a-8648-9bc1208e1761", "confidence": 100, "external_references": [ { "source_name": "Vanguard Group Inc.", "url": "https://oag.ca.gov/system/files/ELN-28726%20Vanguard%20Group%20Ad%20CM%203y%20L2%20r7prf.pdf", "external_id": "cit:39cd72d8-c4f0-459f-b179-ad82c84cdf95", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:fd67191914867807d1590dcaae6a631d49ca6840baf94c4d88a5ade3832b0f6c" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Vanguard used outside cybersecurity experts, coordinated with law enforcement and strengthened monitoring and employee training. It offered three years of credit and identity monitoring." } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--0c3d99bd-a425-5bed-86ca-b9491ab5f67d", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "evt:c5b9e094-a5a4-4a9a-9dc0-ce71eab5f6a3", "name": "Reported incident interval ends" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--5aedc62c-63fd-58b8-832c-5792f8ad6e71", "created": "2026-11-13T14:14:35.229358+00:00", "modified": "2026-11-13T14:14:35.229358+00:00", "x_ally_original_id": "evt:cec686e7-24b6-497a-980e-226f19ca989d", "name": "Social-engineering incident begins" } ] }