{
  "type": "bundle",
  "id": "bundle--28ecec6a-f7f3-55c3-99be-65911e75644c",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-15T11:55:05.370Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--d3d47f3c-fcc1-5bf0-957c-eb55ba5b1f59",
      "name": "DaOnlySpark",
      "aliases": [
        "DaOnlySpark"
      ],
      "description": "DaOnlySpark is a forum actor claiming to have leaked sensitive data from AdvaCare, including internal financial details, and from Jinko, comprising 3.7 GB of patient records, clinical profiles, and private messages. Both claims remain unverified.",
      "external_references": [
        {
          "source_name": "skopnix",
          "external_id": "daonlyspark",
          "url": "https://skopnix.com/actors/daonlyspark"
        },
        {
          "source_name": "hendryadrian.com",
          "url": "https://www.hendryadrian.com/advacare-dataset-claimed-on-forum-20734-timesheet-entries-and-39-staff-accounts/"
        },
        {
          "source_name": "hendryadrian.com",
          "url": "https://www.hendryadrian.com/jinko-patient-records-published-with-diagnoses-and-private-messages/"
        }
      ]
    }
  ]
}