starship / search / efulfillment-service-order-fulfillment-for-ecommerce

Audit report

eFulfillment Service

CriticalReach : broad

by eFulfillment Service · Orders and shipping · Shopify App Store

Orders and shipping

Risk level

Critical

Executive summary

Order Fulfillment for Ecommerce

Key insights

◆Publisher is a U.S.-based 3PL (third-party logistics) provider, not a pure software vendor
◆Suffered Akira ransomware claim on Feb 4, 2026, material recent incident
◆Privacy policy claims 30-day retention max for customer PII and 72-hour breach notification
◆OAuth scopes not explicitly enumerated on the Shopify App Store listing page

Top findingsview all

Critical
Akira ransomware attack (Feb 2026)
High
No SOC2/ISO27001 certification; minimal compliance posture

Synthesis

Analysis summary

Order Fulfillment for Ecommerce

Key insights

◆Publisher is a U.S.-based 3PL (third-party logistics) provider, not a pure software vendor
◆Suffered Akira ransomware claim on Feb 4, 2026, material recent incident
◆Privacy policy claims 30-day retention max for customer PII and 72-hour breach notification
◆OAuth scopes not explicitly enumerated on the Shopify App Store listing page
◆Publisher website served via Cloudflare with strong CSP, but no HSTS
◆No mention of LLM/AI usage in privacy policy
◆Built for Shopify badge not present

Detections

Findings (4)

Risks detected through static, network, and policy analysis.

Akira ransomware attack (Feb 2026)

Critical

On February 4, 2026, the Akira ransomware group claimed responsibility for a cyberattack against eFulfillment Service (efulfillmentservice.com). As a 3PL handling order/customer data for ecommerce merchants including Shopify stores, a ransomware incident affecting their infrastructure represents a direct material risk to merchant data processed via this integration.

Evidence

https://www.ransomware.live/id/ZWZ1bGZpbGxtZW50IFNlcnZpY2VAYWtpcmE=

No SOC2/ISO27001 certification; minimal compliance posture

High

Privacy policy references CCPA and GDPR rights but discloses no SOC2, ISO27001, PCI DSS, or HIPAA certifications. For a 3PL handling customer PII (name, address) of Shopify orders, the lack of recognized security certifications is a notable gap, compounded by the Akira ransomware incident.

Evidence

https://www.efulfillmentservice.com/privacy-policies/integration-app/

Missing HSTS header on publisher domain

Medium

Publisher domain (efulfillmentservice.com) returns HTTP/2 200 over HTTPS via Cloudflare with a CSP header set, but no Strict-Transport-Security header was observed in the response, leaving HTTPS downgrade attack surface exposed.

Evidence

https://www.efulfillmentservice.com/

Low review volume on Shopify App Store (2 reviews, 2.4 rating)

Low

App has only 2 reviews with a 2.4 average rating, indicating limited adoption / scrutiny via the Shopify channel and mixed user satisfaction. Not a security defect per se but limits public visibility of issues.

Evidence

https://apps.shopify.com/efulfillment-service-order-fulfillment-for-ecommerce

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_orders`	High	Required to receive new orders for fulfillment
`write_orders`	High	Required to mark orders fulfilled and post tracking numbers
`read_products`	Medium	Required to map SKUs between Shopify and the 3PL
`write_inventory`	High	Required to sync stock levels into Shopify
`read_customers`	High	Required to retrieve ship-to PII for parcel labels

read_orders

High

Required to receive new orders for fulfillment

write_orders

High

Required to mark orders fulfilled and post tracking numbers

read_products

Medium

Required to map SKUs between Shopify and the 3PL

write_inventory

High

Required to sync stock levels into Shopify

read_customers

High

Required to retrieve ship-to PII for parcel labels

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: efulfillmentservice.com
TLS grade: A
HSTS: Missing
CSP: Enabled

Cloudflare-fronted HTTPS, broad CSP allowlist including unsafe-inline and unsafe-eval; HSTS not advertised on root response

Posture

Compliance & certifications

GDPR webhooks Pass

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

CCPA + GDPR rights addressed; 30-day data retention; 72-hour breach notification commitment; no formal third-party security certifications disclosed

Track record

Publisher reputation

Publisher: eFulfillment Service
Verified Shopify Partner: No
Years active: 0
Other apps: 0

Past incidents

●2026-02-04 · ransomware · Akira (https://www.ransomware.live/id/ZWZ1bGZpbGxtZW50IFNlcnZpY2VAYWtpcmE=)

LLM exposure

AI / LLM usage

No LLM usage detected. This app does not appear to forward any customer or merchant data to large-language-model providers.

eFulfillment Service

Key insights

Top findingsview all

Analysis summary

Findings (4)

Akira ransomware attack (Feb 2026)

No SOC2/ISO27001 certification; minimal compliance posture

Missing HSTS header on publisher domain

Low review volume on Shopify App Store (2 reviews, 2.4 rating)

OAuth scopes requested

Data flow

Theme code analysis

Network surface

Compliance & certifications

Publisher reputation

AI / LLM usage