A fulfillment provider is a third-party company that stores, processes, and ships customer orders for a merchant. It may handle names, addresses, order numbers, delivery status, and sometimes return or support records. In cyber security, that makes it part of the merchant’s supply chain, because sensitive customer data can sit outside the merchant’s direct control.
Fulfillment providers matter because even “ordinary” shipping data can help attackers. A real order record can be used to craft believable phishing emails, fake delivery notices, or support scams that mention the correct product, date, or customer details. Defenders reduce this risk by limiting what data the provider receives, enforcing short retention periods, restricting subcontractor access, and verifying deletion or anonymization when orders are complete.