# Revolve breach may have exposed customers' saved payment card numbers · pwn.watch > Online fashion retailer Revolve Group disclosed in an Oct 29 2026 SEC filing that an unauthorized actor accessed some of its systems. Based on its investigation, Revolve believes the actor may have obtained, through automated means, the name, contact information, payment card number and card expiration date of certain customers who had saved payment information in their online shopping accounts. Revolve says the activity was remediated, it notified federal law enforcement and hired outside cybersecurity experts, and the incident did not disrupt operations or customer service. It has not said how many customers are affected or how the attacker got in. Page: https://pwn.watch/i/revolve-saved-payment-card-data-breach-oct-2026 · generated 2026-10-30T16:22:57.349Z ## Status - Severity: high · status: live · patch: partial - Product: Revolve e-commerce platform (Revolve Group) - Started: 2026-10-29 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/revolve-saved-payment-card-data-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/revolve-saved-payment-card-data-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/revolve-saved-payment-card-data-breach-oct-2026.json - This file: https://pwn.watch/i/revolve-saved-payment-card-data-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-10-29: Revolve Group files a Form 8-K saying it recently found unauthorized access to some of its systems and that the activity was remediated. It believes an unauthorized actor may have obtained, through automated means, the name, contact information, payment card number and card expiration date of certain customers who saved payment information in their online shopping accounts. It notified federal law enforcement and brought in outside cybersecurity experts. (https://www.sec.gov/Archives/edgar/data/1746618/000119312526439022/0001193125-26-439022-index.htm) ## Fix brief # Security brief: Revolve breach may have exposed customers' saved payment card numbers Source: https://pwn.watch/i/revolve-saved-payment-card-data-breach-oct-2026 · status: live · severity: high · updated Oct 30, 2026, 13:00 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Online fashion retailer Revolve Group disclosed in an Oct 29 2026 SEC filing that an unauthorized actor accessed some of its systems. Based on its investigation, Revolve believes the actor may have obtained, through automated means, the name, contact information, payment card number and card expiration date of certain customers who had saved payment information in their online shopping accounts. Revolve says the activity was remediated, it notified federal law enforcement and hired outside cybersecurity experts, and the incident did not disrupt operations or customer service. It has not said how many customers are affected or how the attacker got in. Severity detail: Payment card numbers and expiration dates of customers with saved cards may have been taken; number of affected customers not disclosed - Product: Revolve e-commerce platform (Revolve Group) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes There is nothing to patch. If you saved a card in a Revolve account, watch your statements for unfamiliar charges and consider asking your bank for a new card number; expect phishing that uses your name and contact details. Re-check for Revolve customer notifications, an affected-customer count and the attack method. ## Latest updates - Oct 29, 2026: Revolve Group files a Form 8-K saying it recently found unauthorized access to some of its systems and that the activity was remediated. It believes an unauthorized actor may have obtained, through automated means, the name, contact information, payment card number and card expiration date of certain customers who saved payment information in their online shopping accounts. It notified federal law enforcement and brought in outside cybersecurity experts. ## Advisories - [Revolve Group, Inc. Form 8-K, Item 8.01 Other Events (cybersecurity incident)](https://www.sec.gov/Archives/edgar/data/1746618/000119312526439022/0001193125-26-439022-index.htm) (U.S. SEC) ## Write-ups & news - [Revolve Group reports unauthorized access to customer payment data](https://www.streetinsider.com/Corporate+News/Revolve+Group+reports+unauthorized+access+to+customer+payment+data/27260922.html) - [Revolve Group reports cybersecurity incident affecting customer data](https://www.investing.com/news/sec-filings/revolve-group-reports-cybersecurity-incident-affecting-customer-data-93CH-4986527) ## Caveats Revolve says the unauthorized activity was remediated and enhanced security measures are being put in place. The filing does not mention card security codes (CVV) or passwords, and does not give a count of affected customers. --- Machine-readable: https://pwn.watch/i/revolve-saved-payment-card-data-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.