Revolve Says Hackers May Have Taken Saved Payment Card Details

The Revolve data breach affects customers who saved a payment card in their online account with the US fashion retailer, which says an intruder may have taken their card numbers and expiry dates along with their names and contact details. Revolve, which runs Revolve.com and FWRD.com, disclosed the incident in a filing with the US Securities and Exchange Commission dated Thursday 29 October.

“Based on its investigation, the Company believes that an unauthorized actor may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information associated with their online shopping account on the Company’s e-commerce platform,” Revolve said in the Form 8-K.

Revolve’s filings and letter say nothing about card security codes, the three digits on the back of a card. Nor does the company say when the attack happened or how many customers were affected in total.

Revolve data breach: what the filings say

Revolve, based in Cerritos, California, says it “recently became aware of unauthorized access to certain of its systems”. It says it started its incident response plan, “confirmed the unauthorized activity was remediated”, notified federal law enforcement and brought in outside cybersecurity experts.

The company says the incident caused no disruption to its service and that it does not expect it to “have a material impact on its business”. That is a statement about Revolve’s finances. It says nothing about the risk to the customers whose cards were on file.

State breach filings give the only numbers so far. The Texas Attorney General’s breach report list shows Revolve reported 127,200 affected Texans, with names and financial information such as card numbers involved. The listing was published on Friday 30 October and says notices went out by post and on a website. The Vermont Attorney General’s list shows 1,328 Vermont residents, in a notice dated 29 October. Vermont warns that such numbers may rise as companies work out the totals.

Revolve’s letter to customers, a copy of which was filed with Massachusetts regulators, tells each person that the incident “involved your name and address, as well as the card number and expiration date” for the card ending in the digits shown. The Record, which first reported the state filings, said Revolve “did not respond to questions about when the attack occurred”.

What Revolve customers should do now

If you have shopped on Revolve or FWRD with a saved card, these steps for the Revolve data breach make sense whether or not a letter has reached you yet.

1. Check your card statements. Revolve’s letter advises customers to “review your payment card statements for any unauthorized charges” and to report them straight away to the card issuer. It notes that card rules “generally provide that cardholders are not responsible for unauthorized charges reported in a timely manner.” The issuer’s number is usually on the back of the card.
2. Ask your bank for a new card. If a card was saved on either site, the safest course is to have the issuer cancel it and send a replacement with a new number. That makes the stolen number and expiry date useless, whatever else a criminal holds.
3. Remove saved cards. Delete stored cards from your Revolve or FWRD account, and add the new card again only if you want to.
4. Watch for phishing. Criminals who hold your name, address and email or phone number can write convincing messages that claim to come from Revolve, FWRD or your bank. Be careful with links in any unexpected email or text about your order, refund or card. If in doubt, contact your bank on the number on your card, or call Revolve’s helpline, which its letter gives as 888-517-6458 (9am to 9pm US Eastern time, Monday to Friday).
5. Consider fraud alerts or a credit freeze. The letter explains how US residents can get free credit reports and place a fraud alert or a free security freeze with Equifax, Experian and TransUnion. It does not offer credit monitoring.

Why a card number and expiry date are still worth stealing

Leaving out the security code limits the damage, but it does not make the stolen data harmless. Not every online checkout asks for the three-digit code, and a card number with a valid expiry date can be tested with small purchases to see whether it still works. Revolve’s own wording, that the data was obtained “through automated means”, suggests software rather than a person did the collecting, but Revolve has not explained what it meant.

The bigger risk in the Revolve data breach may be what comes next. It pairs card details with names and contact details, which is the raw material for targeted fraud. A message that quotes the last four digits of your card and your home address looks far more believable than generic spam. We saw the same concern with the Muji app breach this week, where the leaked data was limited to email addresses and personal details but still opened the door to fake Muji emails.

It also matters that the numbers are coming from state filings, one state at a time. Texas and Vermont alone account for 128,528 people, so the full Revolve data breach is at least that large and almost certainly larger. Until Revolve publishes a total or confirms the attack window, customers have to treat any saved card as exposed. Regulators can act on breaches like this long after the event, as the 23andMe settlement with California shows. For more on how breaches unfold at companies people trust with payments, see our report on Polymarket halting trading after a provider compromise and our ransomware and cyber attacks hub.

What Revolve has not said

On the Revolve data breach, the company has not said when the attack began, how long the intruder had access, who was behind it, or how many customers were affected across the US and abroad. It has not explained the “automated means” or said whether any stolen cards have been used. Its 8-K describes the investigation as ongoing.

Sources

• Revolve Group, Inc., Form 8-K, Item 8.01, dated 29 October 2026: https://d18rn0p25nwr6d.cloudfront.net/CIK-0001746618/e2e023f7-6a33-44ef-b722-19d674c3fddf.pdf
• Office of the Texas Attorney General, Data Security Breach Reports (Revolve Group, Inc., published 30 October 2026): https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage
• Vermont Attorney General, Security Breach Notices (Revolve Group, Inc., 29 October 2026): https://ago.vermont.gov/categories/security-breach-notices
• Revolve Group, Inc., consumer notice letter, as filed with the Massachusetts Attorney General: https://www.mass.gov/doc/2026-1895-revolve-group-inc/download
• The Record, Jonathan Greig, 30 October 2026: https://therecord.media/resolve-fashion-retailer-data-breach-payment-cards

Related stories

• 23andMe Successor Settles With California for $6m Over 2023 Breach
• Polymarket Halts Trading, Says a Third-Party Provider Was Compromised
• Muji Says App Breach May Have Exposed Up to 27.26m Customer Records