Revolve breach may have exposed customers' saved payment card numbers

Online fashion retailer Revolve Group disclosed in an Oct 29 2026 SEC filing that an unauthorized actor accessed some of its systems. Based on its investigation, Revolve believes the actor may have obtained, through automated means, the name, contact information, payment card number and card expiration date of certain customers who had saved payment information in their online shopping accounts. Revolve says the activity was remediated, it notified federal law enforcement and hired outside cybersecurity experts, and the incident did not disrupt operations or customer service. It has not said how many customers are affected or how the attacker got in.

Why this severity: Payment card numbers and expiration dates of customers with saved cards may have been taken; number of affected customers not disclosed

Started

Oct 29, 2026

• #Revolve
• #E Commerce
• #Retail
• Data breach
• #Payment Cards

Notes & caveats

Revolve says the unauthorized activity was remediated and enhanced security measures are being put in place. The filing does not mention card security codes (CVV) or passwords, and does not give a count of affected customers.