A security architect is building a threat model for a new customer-facing web application using the STRIDE methodology. During a design review, a developer notes that an attacker could intercept and modify order data in transit between the web tier and the payment API because the internal service call uses plain HTTP. Which STRIDE threat category does this finding map to, and which component of the threat model does it primarily represent?