E-commerce Skimmer in a Tag Manager Container
An online retailer's checkout page loads a third-party chat widget and a tag manager container. Payment card fields are rendered in an iframe served by a PCI-validated payment service provider, so the retailer believes its site never handles PAN. A forensic review finds obfuscated JavaScript in the tag manager container that reads and exfiltrates form fields to an unknown domain. Web server logs show HTTP POSTs to that domain at 3–7 requests per minute for 11 days. Application debug logs, enabled during a troubleshooting window, contain full PANs and expiration dates for 1,900 orders. The retailer processes about 2.1 million orders per year. The WAF logged no alerts because the exfiltration used allowed HTTPS. The marketing team controls the tag manager and deploys changes without security review.
1. Is the retailer's assertion that its site is out of scope for PCI DSS correct? Explain the CDE boundary and the impact of the tag manager and iframe.
Read the worked answer
The assertion is too broad. An iframe served by a PCI-validated PSP can reduce the merchant's exposure, but it does not automatically remove the merchant's site from scope. If the merchant can modify the page that hosts the payment iframe, or if scripts on that page can influence the payment experience, the site is likely connected-to the CDE and may fall under a more demanding self-assessment than the merchant assumes. The compromised tag manager is especially significant because it executes in the merchant's page context and can overlay, redirect, or manipulate form fields around the iframe, even if it cannot read cross-origin iframe content directly. The debug logs containing full PANs independently place the application server in the CDE and create a clear cardholder-data storage issue. The marketing team's unreviewed deployments mean change control over CDE-connected scripts is absent. The PFI should document the exact script behavior, the iframe origin and isolation, and whether any PAN appeared in the merchant's DOM or logs. Scope should include the web servers, tag manager, marketing deployment pipeline, and any system that can alter the checkout page.
2. What evidence establishes whether card data was exfiltrated, and how should the PFI bound the compromise?
Read the worked answer
The PFI should decode the obfuscated JavaScript, identify the exfiltration endpoint and data format, and determine whether it captured fields inside the PSP iframe or only fields on the merchant page. Review the tag manager version history and deployment audit trail to find when the malicious container was published; the 11-day POST window is a starting point, not necessarily the full exposure period. Analyze web server and proxy logs for POST bodies, user agents, and timing, and correlate with application debug logs to see whether PANs were present in the same sessions. Check whether the debug logs were accessible to the attacker and whether the exfiltration endpoint received encoded data that can be decoded. Review DNS and egress logs, WAF and CDN logs, and any preserved browser telemetry. Count affected orders by date range and by data type, and look for other tag containers or scripts. The PFI should also test whether the skimmer could read iframe fields, because that changes the affected population. Bound the incident using the earliest malicious deployment, not merely the first observed POST.
3. What reporting and remediation priorities follow from these findings?
Read the worked answer
The PFI should report the confirmed script compromise, the PAN exposure in debug logs, and the unresolved question of whether iframe data was captured. The retailer should notify its acquirer and card brands according to its incident response obligations, inform the PSP, and preserve all logs and tag manager versions. Remediation should remove the malicious container, disable debug logging that records PAN, rotate credentials used by the tag manager and web application, and review all marketing scripts for similar injection. The retailer should implement script governance: restrict who can publish tags, require security review and integrity controls, and use a content security policy that limits script origins and exfiltration endpoints. WAF and egress monitoring should alert on unusual POST destinations, not only known signatures. Because the marketing team deploys without review, the PFI should recommend segregation of duties and a change-management process for any script that can affect checkout. Finally, the report should distinguish confirmed PAN exposure from potential exposure and state the basis for each conclusion.