Online fashion retailer Revolve Group (NYSE: RVLV) has confirmed that an unauthorized actor may have stolen saved payment card data from customer accounts on its e-commerce platform. The company disclosed the incident in a Form 8-K dated October 29, 2026, and filed with the U.S. Securities and Exchange Commission, without saying how many customers were affected. A breach report Revolve submitted to the Texas Attorney General puts the total at 1,515,073 individuals.
According to the 8-K filing, the attacker may have obtained the data “through automated means” from customers who saved payment information to their online shopping accounts. Some early press coverage misspelled the company’s name as “Resolve.”
Four data points tied to saved cards
Revolve’s filing lists the following information as potentially obtained for affected customers:
- Names
- Contact information
- Payment card numbers
- Payment card expiration dates
The filing does not mention card security codes, account passwords, Social Security numbers or order history. It also does not say whether the card numbers were complete or partially masked, or whether the saved cards were stored in Revolve’s own systems or with a payment processor.
The state filings fill in the numbers
The 8-K gives no customer count, but the state breach registers do. Revolve’s Texas report, published by the attorney general’s office on October 30, lists 127,200 affected Texans and 1,515,073 affected individuals in total. The Vermont Attorney General lists 1,328 affected Vermont residents in a notice dated October 29, with financial account codes and credit and debit card information marked as exposed.
Revolve also reportedly filed notices with regulators in Massachusetts and Iowa. The Texas report says Revolve notified affected consumers by U.S. mail and through a notice posted on its website.
One day of access, 18 days to detection
The Texas filing lists September 11, 2026 as both the start and end date of the breach, which points to a single day of unauthorized activity. Revolve discovered the incident on September 29, 18 days later, according to the same report. Public disclosure through the SEC and state regulators followed about a month after discovery.
In the 8-K, Revolve says it activated its incident response protocols, confirmed the unauthorized activity was remediated, notified federal law enforcement and brought in outside cybersecurity experts. The company says it has added security measures designed to prevent a similar event.
What “automated means” leaves unanswered
Revolve has not explained what it means by automated means. The filing does not say whether the attacker logged in to customer accounts, abused a flaw in the website or planted a skimmer on the checkout page, and BreachNews is not drawing a conclusion about the method. The company also has not said how the attacker first reached its systems.
Revolve reportedly did not respond to press questions about when the attack occurred. Revolve had not issued any public statement beyond its regulatory filings at time of publication. No ransomware or extortion group has publicly claimed responsibility, and there is no public sign that the stolen card data has been offered for sale.
No material impact expected, Revolve says
Revolve says the incident did not disrupt operations or interrupt service to customers, and that it does not expect a material impact on its business. Because the company filed under Item 8.01, a voluntary disclosure, instead of Item 1.05, which covers material cybersecurity incidents, it is treating the event as non-material for investors. That assessment covers Revolve’s finances, not the fraud risk facing customers whose card numbers and expiration dates may now be in criminal hands.
Saved card data keeps drawing attackers
Online retailers that keep saved payment details are frequent targets. BreachNews previously covered the ASOS breach that followed stolen credential attacks on customer accounts and a Magecart campaign that hijacked the Convertr analytics script to steal card data. There is no public evidence linking either incident to Revolve.
Steps for Revolve customers with saved cards
- Ask your card issuer to replace any card saved to your Revolve account, using the phone number on the back of the card.
- Review card statements and turn on transaction alerts, watching for small test charges as well as larger purchases.
- Remove saved cards from your Revolve account and other shopping sites you rarely use.
- Set a unique password for your Revolve account and change it anywhere else you reused it.
- Be wary of emails or texts claiming to be from Revolve about the breach, and go to
revolve.comdirectly instead of clicking links.
Customers who receive a notice letter can follow the BreachNews guide on how to respond to a data breach notification.
