The source of the malicious data was Cloud Service Consumer A. This program forwarded malicious data in the message it sent to Cloud Service X. Because Cloud Service X and Cloud Service Y share the same underlying physical server, this data compromised IT resources on that physical server that further compromised Virtual Server Y and Cloud Service Y.

The source of the malicious data was Virtual Server Y. This virtual server was independently attacked. The attacker managed to place malicious software on the virtual server which inserted malicious data into the message sent by Cloud Service Y to Cloud Service Consumer B.