Architectural Transformation of Personal Data Storage in E-Commerce

Abstract

The article examines cybersecurity issues in e-commerce information systems in the context of supply chain attacks and contractor compromise. It is demonstrated that the centralized Web 2.0 architecture, which relies on storing customers’ personal data within service infrastructures, creates structural vulnerabilities and increases the risk of large-scale data breaches when auxiliary components are compromised. Using the incident involving a contractor servicing the National Bank of Ukraine’s numismatic online store as an example, the need to reconsider approaches to personal data management is substantiated. An architectural model based on the principles of self-sovereign digital identity, selective attribute disclosure, and the use of temporary cryptographic access tokens is proposed. In this model, personal data remains under the control of the customer, while e-commerce systems verify the validity of attributes without centralized data accumulation. It is shown that the transition from data storage to proof verification reduces the attack surface and minimizes the consequences of contractor compromise.