A tampered third-party script skims cards on your checkout page
The prompt — read this to the room
Your acquiring bank emails: card-fraud analysis links 212 fraudulent transactions to cards used on your online store over the past five weeks, and they want a forensic investigation. Your developers find nothing changed in your own code. Then a front-end engineer notices the checkout page loads a chat widget from a vendor's CDN, and the script now contains 40 extra lines of obfuscated JavaScript that post form fields to an unfamiliar domain. The widget is on every page, including payment. Peak-season trading starts in nine days. What do you remove, what do you keep, and what do you tell the bank?
Who to involve
Most important first.
- Incident response lead
- Developer / DevOps
- CISO / Head of security
- Vendor / procurement manager
- Legal counsel
- Communications / PR
What it tests
- Contain the skimmer and confirm removal across caches, CDNs and every page that loads it
- Scope affected transactions and dates for the acquirer and the forensic investigator
- Assess payment-page script controls against PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1
- Decide customer notification and peak-season readiness with legal and comms
Outline of activities
- 1The acquirer's email and the strange script
- 2Containment: remove, block, verify
- 3Scoping the exposure window
- 4Forensic investigator, card brands and notification
- 5Hardening before peak: script inventory and change detection
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…
More third party exercises
- Your help-desk SaaS provider is breached and its tokens into your systems are stolen1 h 45 min · Intermediate · Mixed
- Your managed service provider's remote tool starts pushing scripts to every server2 h 30 min · Advanced · Mixed
- Your payroll provider goes down two days before payday1 h 15 min · Starter · Executive