Online fashion retailer Revolve Group says an unauthorized actor may have obtained customers’ names, contact information, payment-card numbers and expiration dates in a breach affecting people who saved payment details in Revolve or FWRD shopping accounts. The company disclosed the incident in an October 29 filing with the U.S. Securities and Exchange Commission, but did not state a nationwide victim count. [11]
State filings suggest the incident could be substantially larger than the company’s SEC disclosure indicates. A Texas notification lists 127,200 affected Texas residents and reports a total of 1,515,073 people potentially impacted, although Revolve has not publicly confirmed that nationwide figure. Massachusetts separately reported 46,813 affected residents in its breach-notification records. [3][12]
According to the SEC filing, Revolve believes the information was obtained “through automated means” from its e-commerce systems. State records indicate the unauthorized activity occurred on September 11, 2026, and was discovered on September 29. The company said it activated its incident-response procedures, engaged outside cybersecurity experts, notified federal law enforcement and implemented additional security measures. It also said the incident did not disrupt operations or interrupt customer service. [6][11]
The exposed information includes payment-card numbers and expiration dates, along with names and addresses listed in customer notification letters filed with the Massachusetts attorney general. Neither the SEC filing nor the available state notices says whether card numbers were fully visible or masked, and the disclosures do not mention card-verification values, or CVVs. Revolve also has not identified a threat actor, published evidence of a public exploit or attributed the incident to a known criminal group.
Customers who stored payment information with Revolve should review card and bank statements for unfamiliar transactions, including small test charges, and report suspicious activity to their card issuer promptly. They should consider asking the issuer to cancel and replace an exposed card, while removing stored payment details from online shopping accounts. Because attackers may possess names, addresses and genuine card information, customers should also treat unsolicited calls, texts and emails about the breach as potential phishing attempts and independently contact their bank using the number printed on the card.
References
- OneCard MA Adult No CM_Source.pdf
- RVLV 8-K Filings – Revolve Group, Inc. SEC 8-K
- 8-K
- 2026 Data Breach Notification Report The total number of …
