{
  "type": "bundle",
  "id": "bundle--f90ebba2-a5e9-5fed-876c-308437b09fe0",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--047abd58-96be-537f-8a95-77982771e761",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:aa363686-efec-56b7-8e25-bcbded05f820",
      "name": "Workday",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--0daae938-a236-56de-894a-3128306a7a26",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:31e8bffc-d9ad-55d9-a118-0878f9666e01",
      "name": "Workday security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--6c2a7b3a-09aa-5516-81e5-17cbe9a7420e",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:e8e45c4d-9bff-57ee-aed8-e211ac1831a6",
      "name": "Workday security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--77c93d8d-7c4a-5a64-865b-ae73e272cc09",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:d3e75c89-de47-58a5-90e1-45d338992e42",
      "relationship_type": "affected-organization",
      "source_ref": "incident--6c2a7b3a-09aa-5516-81e5-17cbe9a7420e",
      "target_ref": "identity--047abd58-96be-537f-8a95-77982771e761",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Workday",
          "url": "https://blog.workday.com/en-us/workdays-response-salesloft-drift-security-incident.html",
          "external_id": "cit:fd37c845-49a0-5027-8cb3-2a5ce8225463",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:37ab10a10b6ffcc2f7a1a26eee36bbd7d618021c928ff7f3359419f4aa7bdaa6"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0d512726-0e83-53f2-8311-762e76fe17a8",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:095e1b62-7659-5e15-904f-326d8f942cf8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Workday",
          "url": "https://blog.workday.com/en-us/workdays-response-salesloft-drift-security-incident.html",
          "external_id": "cit:d06def1f-83bf-5e17-bd02-bc3802c0ff4d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:37ab10a10b6ffcc2f7a1a26eee36bbd7d618021c928ff7f3359419f4aa7bdaa6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the workday security incident involving Workday."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2f82c897-49ed-5423-8349-232b05036a3c",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:20570dcd-2426-5fa0-ac2a-fe9130148ebe",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1566/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--55d53beb-d29c-51c5-8909-f2d4d3f4885b",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:54f968bd-0a42-5ef3-966a-9feabae5c18f",
      "confidence": 90,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1528/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--844059d8-eda6-5d7c-88c0-0fdcb253c467",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:74c7568f-a854-5f61-b81f-6d00bc702e8c",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Workday",
          "url": "https://blog.workday.com/en-us/workdays-response-salesloft-drift-security-incident.html",
          "external_id": "cit:8a865119-9486-5375-b70c-9ca5aac6152b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:37ab10a10b6ffcc2f7a1a26eee36bbd7d618021c928ff7f3359419f4aa7bdaa6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2025-09-08"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b33ebe23-76a2-588e-8fa6-00f1c39d6f17",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:66370e23-9945-5742-a74f-eb25d998fbd7",
      "confidence": 92,
      "external_references": [
        {
          "source_name": "Workday",
          "url": "https://blog.workday.com/en-us/workdays-response-salesloft-drift-security-incident.html",
          "external_id": "cit:356a6e0a-3daf-5075-900e-e4cd8715272b",
          "description": "The threat actor’s searches only provided access to a very small subset of information from our Salesforce environment, such as business contact information, basic support case information, basic tenant related attributes such as tenant name, data center name, product names and services, training courses and certificates, and event logs.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:37ab10a10b6ffcc2f7a1a26eee36bbd7d618021c928ff7f3359419f4aa7bdaa6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Business contact data exposed."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f6e6a64d-3c0d-512b-8cce-5e5bc7ecd39a",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:1e39fc81-3a48-5109-a05d-b915e6db5f59",
      "confidence": 84,
      "external_references": [
        {
          "source_name": "Workday",
          "url": "https://blog.workday.com/en-us/workdays-response-salesloft-drift-security-incident.html",
          "external_id": "cit:ea02b0c8-1e52-5984-a856-339eb2c7f618",
          "description": "On August 23, 2025, Workday became aware of a security issue in Salesloft’s Drift application, a third-party app that connects to Salesforce.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:37ab10a10b6ffcc2f7a1a26eee36bbd7d618021c928ff7f3359419f4aa7bdaa6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Voice phishing induced personnel to authorize a malicious connected OAuth application in Salesforce."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--59a60115-6694-5e9d-8ca7-343103257d99",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:377d68a2-6c98-5d40-826c-84bb828a180f",
      "name": "Documented public update"
    }
  ]
}