Information leakage is a major obstacle to achieving PCI DSS compliance.

PCI DSS Requirements 3, 4, and 6 mandate that cardholder data be protected at rest and in transit, and that applications do not leak sensitive data through error messages, verbose responses, or insecure storage. Information leakage can expose Primary Account Numbers (PANs), authentication data, or infrastructure details that undermine the entire compliance posture.

Stating this is false would be incorrect because information leakage is explicitly addressed across multiple PCI DSS requirements and is a well-recognized barrier to achieving and maintaining compliance.