Revolve data breach: saved payment cards and personal data of at least 179,000 customers exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-10-29
Revolve Group disclosed in a Form 8-K dated 2026-10-29 (Item 8.01) that it recently became aware of unauthorized access to certain systems, and that an actor may have obtained, through automated means, names, contact information, payment card numbers and expiration dates of customers who had saved payment information to their accounts. Revolve says it promptly started incident response, confirmed the activity was remediated, notified federal law enforcement, and engaged outside cybersecurity experts. It reports no operational disruption and no expected material business impact. The Record, dated 2026-10-30, reports that Revolve told Texas regulators 127,200 residents had information stolen, cites 1,328 victims in Vermont, and says notices were also filed in Massachusetts without a count. SecurityWeek, citing state attorney-general notices, reports letters to at least 179,259 people. SecurityWeek also says the incident occurred on September 11, but no year appears in the text we read, and neither the 8-K nor The Record gives an attack date. No attacker has been named and no intrusion vector has been published. Revolve is not offering free identity or credit monitoring; customers are advised to review their card statements.
What to do
- Customers who saved a card to a Revolve account: review statements, report unauthorized charges to the card issuer, and consider replacing the card
- Retailers storing card numbers and expiry dates: confirm which systems and staff can query saved-payment data, and review e-commerce platform access controls
Sources
All live incidents on Threat Watch
