Revolve card data breach exposes saved payment card numbers and expiry dates

What happened

Revolve Group filed a Form 8-K with the SEC dated October 29, 2026. It says the company “recently became aware of unauthorized access to certain of its systems,” started incident response, and confirmed the unauthorized activity was remediated. It also notified federal law enforcement and engaged external cybersecurity experts. SEC 8-K

According to the filing, the company believes an unauthorized actor may have obtained, “through automated means,” the name, contact information, payment card number and payment card expiration date of certain customers who saved payment information in their online shopping account on its e-commerce platform. The company says there was no operational disruption or interruption of service, and it does not believe the incident will have a material impact on its business. SEC 8-K

Timing: The Record reports that Revolve did not answer questions about when the attack occurred. The Record SecurityWeek says the incident occurred on September 11. SecurityWeek Malwarebytes says records on the Texas attorney general’s site indicate the incident happened on September 11 and was discovered on September 29. Malwarebytes Revolve itself has not confirmed these dates in the sources provided.

Scale: the SEC filing gives no count of affected people. The figures reported so far differ:

• Revolve told Texas regulators that 127,200 people in that state had information stolen, and 1,328 victims are in Vermont. Breach notifications were also filed in Massachusetts. The Record
• Based on notices filed with the attorneys general of Iowa, Massachusetts, South Carolina, Texas and Vermont, SecurityWeek counts at least 197,072 people who were sent notification letters, and headlines the breach as at least 200,000 people. SecurityWeek
• Malwarebytes found a figure of 1,515,073 in data returned by the Texas attorney general’s site, labeled as the total number of people affected. That figure is not shown on the public listing, and Revolve has not confirmed the total. Malwarebytes

Not confirmed: who carried out the attack, how the attackers got in, which systems were involved beyond the online shopping platform, and whether the card numbers were fully visible or masked. It is also unclear whether Revolve or a third-party payment processor held the card data. No group has publicly claimed responsibility. The SEC filing does not mention card verification values (CVV). Malwarebytes

Revolve is not offering affected people free identity theft or credit monitoring services. It reminds them to review account statements and stay alert for fraud or identity theft. SecurityWeek

Am I affected?

• You may be affected if you saved payment information in your Revolve online shopping account. The company describes the impacted group as “certain customers” with saved payment information. SEC 8-K
• Malwarebytes reports that the breach only affected customers who had saved their payment card as a payment method in their Revolve account. Malwarebytes
• Data at risk: names, contact information (addresses are named in the notice and press reports), payment card numbers and card expiration dates. CVV exposure is not mentioned in the SEC filing and is not confirmed. Malwarebytes
• Notification letters have gone out, and notices were filed in at least Iowa, Massachusetts, South Carolina, Texas and Vermont. Receiving a letter is a sign you are in scope, but the sources do not confirm that every affected person has been notified. SecurityWeek
• There is no CVE, software version or patch involved in this advisory. Not confirmed: any technical flaw behind the intrusion.

What to do now

1. Check whether you saved a card in a Revolve account. If you did, treat that card as exposed.
2. Read your card statements line by line. Criminals often make a small charge first to test whether a card works, so look for unfamiliar merchant names and small amounts. Malwarebytes
3. Report any unauthorized charge to your card issuer immediately.
4. Ask your card issuer to cancel the card and issue a new number so the old number becomes unusable. Malwarebytes
5. Remove saved cards from shopping accounts. A password manager that stores payment autofill data is one alternative. Malwarebytes
6. Do not trust unsolicited calls, texts or emails about the incident. Scammers who know your real card details and contact information can write convincing messages to get your CVV. If someone claims to be your card issuer, call the number printed on your card. Malwarebytes
7. Watch for updates. Revolve has not confirmed the total number of affected people, the attack method or the attacker, and the sources do not say whether more detail will follow. SecurityWeek
8. If you run an e-commerce platform that stores customers’ saved cards, this is a reminder to review who can access that data and how automated access is monitored. This is general advice and is not a finding from the sources.

Sources

• SEC Form 8-K, Revolve Group, Inc., October 29, 2026
• The Record, Fashion retailer Revolve says hackers stole payment card information
• SecurityWeek, Revolve Data Breach Impacts at Least 200,000 People
• Malwarebytes, Revolve card breach: 1.5 million people may be affected