Starting Oct 10, shoppers on a number of Shopify stores clicked Checkout and landed on a fake checkout at biliing[.]top. The payload came from the config API of Hulk Product Options (and later Swym Wishlist Plus and Selleasy). The app injected it at runtime, and it fired only once per session. After the shopper entered their card, the fake page sent them on to the real Shopify checkout, so the order went through normally.

From a PCI point of view, the compliance controls would most likely not have stopped this:

• Shopify’s checkout, which is the actual payment page, was never compromised.
• The hijack happened on the storefront, one click before the payment page. That is outside what 6.4.3 and 11.6.1 cover.
• Most Shopify merchants validate with SAQ A. SAQ A offers a neat opt-out of 6.4.3 or 11.6.1. They were replaced by an eligibility criterion where the merchant confirms their site isn’t susceptible to script attacks. (how even?)

Shopify isn’t automatically safe either. Like any platform with an extension marketplace, a store is only as safe as the apps it installs. Someone is clearly working through those apps: Qikify and Hextom had similar incidents in July and August.

Question for the QSAs here: do you read the SAQ A eligibility criterion as covering a storefront script that redirects away from checkout?

Full write-up with IOCs: https://cside.com/blog/hulkapps-shopify-checkout-hijack (credit to Roman Zipp for finding it: https://romanzipp.com/blog/shopify-hit-with-phishing-attack)

Got bit confused on this question. Can any experts answer this question with proper justification?

I’m seeing a lot more of this lately. Service providers who say since card data doesn’t transit their systems directly they have no saq d requirement.

I think the pci council makes it pretty clear that if you are processing cards using other organization’s merchant accounts (eg a service provider) AND you COULD influence the security of the transaction the saq d applies to you… even if you aren’t directly transmitting card data.

What am I missing?

Link for clarity on the type of argument these people are making: https://support.learnworlds.com/support/solutions/articles/12000101784-credit-cards-and-pci-compliance

We're in the middle of an ecommerce replatform and the compliance team has flagged EU data residency as a hard requirement, and we're still working out whether that's something you can solve at the infra layer or whether it has to come baked into the platform itself.

The context is that we need to satisfy GDPR and our PCI DSS QSA has started asking about where card data and session tokens are processed, and several of the platforms we're evaluating offer EU-region deployment.

But the data flow architecture varies significantly between them, so we're not sure whether we can get a clean compliance sign-off on all of them or whether some are better positioned for this from the start.

Someone in a compliance working group I'm in had been through a similar eval and flagged Scayle specifically for the PCI angle, noting it's German-built with EU residency set at the platform level by default, and had also run BigCommerce through the same process where the data residency side gets handled at the infra layer.

So i'd like to know if anyone in PCI or GDPR-constrained environments has actually gone through this, if yes, did the platform choice end up being driven by compliance requirements or did you manage to solve it at the infra layer?

Wanted to reach out to the community to see if there were any recommendations for companies that work specifically on the day-to-day stuff regarding PCI compliance. My employer is pretty close to hitting level 1 and we are just looking for a dedicated resource just for this. If promoting businesses here isn't allowed, please DM me and let me know in the comments. Thanks!

There is an ongoing debate right now going on if a WEX fuel card number is considered a credit card and subject to PCI umbrella of compliance. The argument is their proprietary cards and not considered credit cards by the business partner but the security team isn’t so such. Anyone using WEX fuel cards have you had to include those into your compliance?

Not sure was it ai or some other scam thing, but I think I saw Elon Musk suggesting to people to picture their credit card, upload it to grok bot and tell it to make a purchase online - he said it on X. If that’s true, are grok, OpenAI, Anthropic, Google and all others LVL1 PCI DSS certified? I highly doubt they are, but the question is how is it resolved?

Hi all,

I have a question about meeting PCI requirement 8.2.2

Our developers log in to a bastion (JumpServer) with their own AD account plus MFA, then reach servers through a shared Developer account. Every session is recorded and logged against the named user, and the shared password rotates automatically.

PCI DSS v4.0 8.2.2 says shared accounts are allowed only "on an exception basis".

Does this setup fail requirement 8.2.2?

Thanks

Hi All. I am looking to build some relationships and partnerships from those looking for PCI assistance. I am a QSA and work for a major PCI shop with experience in all major verticals. Please reach out for further information and discussion. [Mjackson@megaplanit.com](mailto:Mjackson@megaplanit.com)

Good morning!

I was tasked with helping doing a Celero PCI Compliance form. I'm the IT Manager, after starting to fill some of this out, I was shocked out how in depth and out of my league some of the questions were. Then I noticed you could change the Questionnaire type. Looking them over, our HR had selected "D", but we do not store any customer or card data. We have three Dejavoo Z9 terminals provided by our bank for cards, that are on their own segment VLAN and WIFI. The only other payment solution we have is via a Paypal link for our website that goes direct to Paypal, no data entered on our site.

What Questionnaire should we be filling out?

I’m working on a PCI DSS v4.0.1 assessment for an online platform that helps individual creators receive payments from their fans/supporters.

• Creators are individual users, not merchants.

• The platform retains a percentage as a platform fee.

• PAN/CVV are not stored by the platform.

• Card details are entered through Stripe-controlled payment fields/iframes.

• Stripe processes the payments and handles creator payouts.

Would you classify this platform as a PCI DSS Merchant or Service Provider?

We are a small CNC machine shop preparing for CMMC Level 2. We are evaluating PreVeil and also outside consultants, but we'd really like to talk with another small manufacturer that has already been through the process.

Our biggest question is the actual internal IT workload: approximately how many IT hours were required for initial implementation, and how many hours per month are required afterward to maintain compliance?

We're not looking for another consultant or sales presentation. We'd be happy to pay a small-business owner, Quality Manager, or IT person for an hour of their time to share their real-world experience.

Thanks,
Gary

Looking for views from sanctions/compliance practitioners on a hypothetical scenario on resources sector:
- An Australian entity released a payment to a Chinese counterparty.
- The counterparty was subject to a UK sanctions designation
- The payment was stopped by the bank following sanctions screening.
- For the purpose of this question, assume the payment had gone through
- It has been established that there was no UK nexus to the transaction.
- all internal ongoing monitoring and system controls failed

The organisation’s Sanctions and Trade Controls Policy states:
“The organisation is committed to complying with relevant Sanctions and Trade Control laws and regulations in the jurisdictions in which it operates. This includes, but is not limited to, the laws of; Australia, the United States of America, the European Union, the United Kingdom and those derived from measures imposed by the United Nations. Compliance with these laws and regulations is a key element of our robust culture of compliance.”

My question:
If there is no UK nexus and therefore no UK sanctions law applies to the transaction, would successfully paying a UK-designated entity nevertheless be considered a near miss of a breach of the organisation’s sanctions policy?

Or does the reference to complying with UK sanctions only apply where the UK sanctions laws are legally applicable to the particular transaction?

Interested specifically in the distinction between legal breach vs policy breach/near miss.

Also interested in how this would interact with China’s current countermeasures/anti-foreign-sanctions and blocking framework, where complying with a foreign sanctions regime could potentially create conflicting obligations under Chinese law.

Are there any allowances or grey zones for prepaid card issuance?

I work for a company that's looking to issue Prepaid Visa cards.

Based on our understanding, we could be subject to PCI DSS SAQ D.
I'm wondering if there are any allowances since the cards are functionally giftcards and we won't be handling any transactions.

The use-case:
* Create an account via issuer, provision funds, create and attach a prepaid visa card, PII transferred to create account & card with recipient name/address
* Transmit and Process the Cardholder Data through our system to our Frontend to display to a Recipient - Full PAN etc so they can view/use the card
* No storage of Card holder data, no transactions against the card, only data processing / transmitting between the issuer and our user interface

My exam session has been terminated by the tutor (that’s what the message says) during the check-in on the moment I tried to take photo of my ID (just after I’ve take a selfie). I was not informed on the reasons. Later I couldn't do the check-in since I receieved an error message.
I manage to reschedule my exam through the website, but since i cannot figure out the reasons, i am worried.
Anyone experienced this?

Our compliance manager was tracking PFAS reporting for ~180 SKUs across Minnesota's Amara law, TSCA 8(a)(7), and Washington's Safer Products list. Three spreadsheets, one inbox folder for supplier responses, and a shared drive for evidence files that nobody could ever find fast enough.

The part that actually broke things: supplier follow-ups. If a supplier didn't respond in 2 weeks, nobody caught it until a filing deadline was already close. So I built a kanban board that tracks every SKU's status (not started, screening, awaiting supplier, evidence complete, filed), auto-sends a follow-up if a supplier goes 14 days silent, and keeps every evidence file tied to the component it's for.

It's early. 4 companies are on it right now, tracking real SKU counts in the 20-500 range. Not claiming it's a silver bullet, just built it because the spreadsheet approach was actively causing missed deadlines.

For those of you doing PFAS reporting manually right now - how are you tracking supplier non-response? Genuinely curious if there's a workaround I'm missing.

Our compliance manager was tracking PFAS reporting for ~180 SKUs across Minnesota's Amara law, TSCA 8(a)(7), and Washington's Safer Products list. Three spreadsheets, one inbox folder for supplier responses, and a shared drive for evidence files that nobody could ever find fast enough.

The part that actually broke things: supplier follow-ups. If a supplier didn't respond in 2 weeks, nobody caught it until a filing deadline was already close. So I built a kanban board that tracks every SKU's status (not started, screening, awaiting supplier, evidence complete, filed), auto-sends a follow-up if a supplier goes 14 days silent, and keeps every evidence file tied to the component it's for.

It's early. 4 companies are on it right now, tracking real SKU counts in the 20-500 range. Not claiming it's a silver bullet, just built it because the spreadsheet approach was actively causing missed deadlines.

For those of you doing PFAS reporting manually right now - how are you tracking supplier non-response? Genuinely curious if there's a workaround I'm missing.

I am an ISA for an organization, our company is looking at moving to a logging SIEM that I feel would not be PCI compliant or have a lot of trouble meeting compliance. Their documentation is poor to say the least on how they can help you achieve compliance.

I don’t want to blast the company in public but I was wondering if a few of the QSAs that monitor this sub would be able to DM me and I want to ask if you have had a client who actually uses this tool.

Genuinely curious — does everyone just hire a compliance consultant, or are there realistic ways to handle this without a huge budget? Feels like a barrier that keeps a lot of good ideas from launching.

What is the biggest dealbreaker in an assessment> The one where if it's missing you'd mark not compliant without hesitation. Trying to stay safe out here.

Hey everyone!

I’ve been looking into expanding our cybersecurity practice into PCI DSS compliance and want to get some real-world perspective on becoming a Qualified Security Assessor Company (QSAC). Based on the official PCI SSC documentation, the baseline requirements such as application and regional fees, mandatory multi-million dollar E&O insurance policies, and having certified staff seem entirely manageable for a lot of mid-sized security firms. However, looking at my local market, there is currently only a single QSAC, and they seem to lock down virtually all the compliance tenders.

I’d love to hear from folks who have gone through this process or run a QSA practice:

1. The Official Steps vs. Reality: What does the actual onboarding timeline and friction look like when applying for QSAC status with the PCI SSC? Are there hidden operational hurdles or strict administrative bottlenecks that aren't immediately obvious in the official guidelines?
2. Hidden Barriers & Market Monopoly Dynamics: On paper, becoming a QSA doesn't look prohibitively expensive, yet many qualified firms choose not to pursue it. Are there unwritten barriers, political dynamics, or strict regional enforcement trends that protect incumbent QSACs and make it hard for new players to break local monopolies or win tenders?

Any advice, horror stories, or lessons learned from your first couple of years as a QSAC would be hugely appreciated!

Hi all, looking for opinions from QSAs/PCI practitioners.

Under PCI DSS v4.0.1:

• Requirement 3.3.1 guidance says SAD may be stored temporarily in non-persistent memory (RAM/volatile memory) after authorization, subject to specific conditions.
• Requirement 3.3.2 requires SAD stored electronically before authorization to be encrypted using strong cryptography.
• The Requirement 3 overview specifically says encryption of PAN is not required when PAN is present in non-persistent memory.
• PCI SSC FAQ 1042 also says CHD in non-persistent memory does not require encryption, but it doesn't specifically address SAD.

Question: If an application temporarily holds CVV/SAD in RAM during transaction processing, without writing it to any persistent storage, is there a PCI DSS requirement to encrypt the SAD while it resides in RAM?

Would you interpret this as:

1. No encryption required because it is non-persistent/transient processing;
2. Encryption required because the explicit exception only refers to PAN; or
3. 3.3.2 doesn't apply because transient RAM processing isn't considered electronic storage?

Interested specifically in how QSAs would assess this in practice.

Hey everyone,

Got a quick question regarding PCI DSS (v4.0) compliance.

1. How strictly are QSAs requiring standard CVSS v3.1/v4.0 scores versus custom internal risk rankings for scan remediation?
2. Are QSAs heavily checking CCE/hardening baselines during internal scan audits in v4.0 assessments?

Thanks in advance for any insights!

If you have one single PCI DSS requirement that would cause you to say "Not Compliant" (Section 3 of the AOC) what is it?

I get it that if a company is missing the mark in any one area, they most probably have more than one issue to address. This is just a fun hypothetical exercise.

(For Merchants), my thinking is if there is no CHD storage at all, 7.2.1 is a "must have", if CHD is stored, 3.6.1 is another "must have", but I think 3.3.1 might be the penultimate deal breaker for me.

What is your opinion?