[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgqPaAM42FBfMulwbNuaHukzvdhyO4uqUeHY_u8N-5oA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"178dbc05-1105-484f-91de-26b631228d68","missing-mfa-on-admin-accounts-led-to-payment-card-skimming-at-danish-fashion-brand","794972dc-37d6-4380-9c97-ae56aebf9cd1","Missing MFA on Admin Accounts Led to Payment Card Skimming at Danish Fashion Brand","Hackers injected malicious JavaScript (a 'Magecart'-style attack) into Designbysi's website over a three-month period, silently stealing customer payment card data at checkout. The Danish DPA found the root cause was the absence of two-factor authentication for staff accounts with access to critical website scripts, meaning a single compromised credential was enough to introduce the malicious code. This violates GDPR Article 32(1), which requires organisations to implement appropriate technical and organisational measures commensurate with the risk — and payment data is unambiguously high-risk. The case illustrates that failing to apply basic access controls to privileged functions is not just a technical shortcoming but a legal liability under European data protection law.","**Immediate actions:**\n- Enforce multi-factor authentication (MFA) on all accounts with write or administrative access to website code, CMS, and hosting platforms.\n- Conduct an emergency audit of all third-party and first-party JavaScript files loaded on checkout and payment pages to detect unauthorised modifications.\n\n**Long-term improvements:**\n- Implement a Content Security Policy (CSP) header to restrict which scripts are permitted to execute on sensitive pages, reducing the blast radius of future injections.\n- Apply the principle of least privilege to all staff accounts, ensuring only personnel who require script-editing access are granted it and that access is regularly reviewed.\n- Establish a formal change-management process requiring peer review and integrity verification (e.g., subresource integrity hashes) before any script is deployed to production.\n\n**Detection measures:**\n- Deploy file integrity monitoring or a web application firewall (WAF) with JavaScript injection detection to alert on unauthorised changes to website assets in near real-time.\n- Implement continuous monitoring and logging of all administrative logins and script-modification events, with alerts for anomalous activity outside business hours.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 32(1) — Appropriate technical and organisational security measures","GDPR Article 32(2) — Risk-based assessment including accidental or unlawful access","CIS Control 4 — Secure Configuration of Enterprise Assets and Software","CIS Control 6 — Access Control Management (MFA requirement)","CIS Control 16 — Application Software Security","NIST SP 800-53 AC-2 — Account Management","NIST SP 800-53 AC-17 — Remote Access (MFA enforcement)","NIST SP 800-53 SI-7 — Software, Firmware, and Information Integrity","NIST SP 800-53 IA-2 — Identification and Authentication (Multi-Factor)","PCI DSS Requirement 6.4 — Protection of public-facing web applications","PCI DSS Requirement 8.4 — Multi-factor authentication for all access into the cardholder data environment","OWASP Top 10 A08:2021 — Software and Data Integrity Failures",{},"published","2026-07-17T08:20:24.213301+00:00","2026-07-17T08:20:23.921+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Denmark)_-_2021-441-9489&diff=52299&oldid=26898","datatilsynet-denmark-2021-441-9489-8407d1","Datatilsynet (Denmark) - 2021-441-9489",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":62,"name":63,"problem":64},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]