Online fashion retailer Revolve Group has confirmed that an unauthorized actor got into some of its systems and may have taken the names, contact details, payment card numbers and card expiration dates of customers who had saved a card to their online shopping account. The company disclosed the incident in a Form 8-K with the US Securities and Exchange Commission, accepted on October 29, 2026. That filing does not say how many people were affected. State breach notices give a range of figures. The lowest is the at least 197,072 people that SecurityWeek counted across five state attorney general filings. The highest is 1,515,073, a figure in the Texas attorney general's breach record that McAfee and Malwarebytes reported. Revolve has not publicly confirmed any nationwide total.
What Happened
Revolve's 8-K says an unauthorized actor accessed "certain of its systems" and used "automated means" to obtain customer payment details. The company says it started its incident response process, remediated the unauthorized activity, notified federal law enforcement, hired outside cybersecurity experts and put in place enhanced security measures meant to prevent a similar event. It reported no operational disruption and no interruption to customer service. As of October 29, it did not expect the incident to have a material impact on its business.
The company filed the disclosure under Item 8.01, "Other Events". That item is for voluntary disclosures. Item 1.05 is the one used for material cybersecurity incidents. This choice fits the company's statement that it does not expect a material impact.
The 8-K gives no dates. Those come from state filings. According to McAfee's reading of Revolve's breach report to the Texas attorney general, the breach happened on September 11, 2026 and Revolve discovered it on September 29. SecurityWeek also gives September 11 as the date of the incident. The Record reported that Revolve did not answer questions about when the attack happened. Customer notification letters started going out around October 29.
| Date (2026) | Event |
|---|---|
| Sept. 11 | Breach occurs, per Texas attorney general records |
| Sept. 29 | Revolve discovers the incident, per the Texas filing |
| Oct. 29 | 8-K accepted by the SEC; customer notifications begin |
| Oct. 30 | 8-K appears on EDGAR; Texas attorney general publishes the breach record |
Nobody has publicly identified the attacker. No group has claimed the attack, and Revolve has not said who was behind it.
What Was Taken
Revolve says the exposed data includes:
- Customer names
- Contact information. The notification letter filed with the Massachusetts attorney general specifies addresses.
- Payment card numbers
- Payment card expiration dates
Only customers who saved a payment card to their Revolve account are affected.
How many people. Here is how the figures compare:
- Texas: 127,200 residents, per the Texas attorney general filing, reported by The Record, McAfee and Malwarebytes.
- Vermont: 1,328 residents, per The Record.
- Five states combined: SecurityWeek counted at least 197,072 people notified, based on filings in Iowa, Massachusetts, South Carolina, Texas and Vermont.
- Possible nationwide total: 1,515,073. Malwarebytes says this number is in the data the Texas attorney general's site returns when you search for Revolve, where it is labelled as the total affected. It does not show on the public listing. Other outlets that repeat it seem to rely on the same Texas record.
The 1.5 million figure is credible because it comes from a regulator record. Still, it is not a public statement by the company. The confirmed floor is roughly 197,000.
What's still unknown. The 8-K does not mention card verification codes (CVV). Malwarebytes notes that it is also unclear whether the stored card numbers were full or masked, and whether Revolve or an outside payment processor held them. Revolve is not offering free credit or identity monitoring.
Why It Matters
A card number and expiration date linked to a name and address is valuable to fraudsters even without the CVV. Some online merchants accept card-not-present transactions without a CVV. Criminals can also use the real details to write convincing phishing messages that trick victims into giving up the security code. Because the stolen records include contact details, affected customers are likely to see this kind of follow-up fraud.
Saved cards are a well-known weak point. Keeping card data on file makes repeat checkout easier, but it also means a single break-in can expose payment data for every customer who opted in. The Record notes that many retailers have faced cyberattacks over the past two years, including Asos, Levi Strauss, Foschini Group, Mango, North Face, Harrods, M&S and The Co-op. Revolve is not small: it reported $347.4 million in net sales in its most recent quarter.
The gap between Revolve's investor disclosure, which gives no count and no dates, and its state filings, which give both, is also worth noting. For anyone measuring the size of a breach, state attorney general portals are often a better source than the SEC filing.
The Attack Technique
Revolve has given almost no technical detail. The only description of the method is the 8-K's phrase "automated means", plus its statement that "certain" or multiple systems were accessed. SecurityWeek reports that the affected systems included the online shopping platform. Breach-Signal describes the activity as automated entry into customer accounts. However, the 8-K does not say this, and the company has not confirmed it.
Our assessment, which Revolve has not confirmed: "automated means" fits several types of attack. One is credential stuffing or account takeover at scale, where stolen passwords are tried against shopper accounts. Another is automated scraping of saved payment data through an application or API weakness. A third is a script that bulk-extracts data after an attacker has gained internal access. Each of these points to different defensive gaps, and Revolve has not said which one applies.
What Organizations Should Do
- Stop storing card data you can avoid holding. Use network tokens or tokens from your payment processor for saved cards so that a breach of your platform never exposes usable card numbers. Show customers only the last four digits.
- Detect automated access to accounts and payment endpoints. Use bot management, rate limits and behavioral detection on login, account and saved-payment endpoints. Alert when many accounts are read in a short period.
- Make account takeover harder. Require multifactor authentication or passkeys for accounts with saved payment methods. Check passwords against breached-credential lists. Ask users to authenticate again before payment details can be viewed or changed.
- Check API authorization. Test account and payment APIs to make sure one user can't read another user's records, for example by changing an ID in a request. Make sure internal services can't pull bulk payment data without a clear business need.
- Track the data, not just the systems. Record and alert on unusual queries against tables or services that hold payment data, so you can find exfiltration within hours instead of the 18 days it took Revolve, going by the dates in the Texas filing.
- Prepare to notify customers and card brands quickly. If saved card data is exposed, work with your acquirer and card brands so issuers can reissue cards. Consider offering monitoring, since not offering it shifts the burden onto customers.
For affected shoppers: ask your card issuer for a new card number, watch your statements, and treat any message asking for your CVV or account details as suspicious.
Sources: Revolve Data Breach: What to Do if You Got a Letter McAfee Blog | Revolve Group, Inc. Form 8-K filed October 30, 2026 | Revolve Data Breach Impacts at Least 200,000 People - SecurityWeek | Fashion retailer Resolve says hackers stole payment card informatio... | Revolve card breach: 1.5 million people may be affected Malwarebytes | Revolve Group says customer card data may be exposed RVLV 8-K Filing | Revolve reports payment card data breach The Paypers | Revolve says hackers stole payment card data from shoppers