Fashion retailer Revolve says hackers stole customers' payment card data

Online fashion retailer Revolve has disclosed that cybercriminals broke into multiple company systems and stole customers' payment card details, according to The Record, which cites the company's filing with the U.S. Securities and Exchange Commission (SEC). The retailer did not provide a total number of people affected, but state-level breach notifications point to well over a hundred thousand customers.

What happened

In an 8-K filing with the SEC, Revolve said attackers gained access to multiple company systems and used "automated means" to obtain customer data, The Record reports. The company said it notified federal law enforcement and hired a cybersecurity firm to lead its recovery. Revolve reported no operational disruptions and said it does not expect a material financial impact from the incident. The company did not respond to The Record's questions about when the attack occurred, so the intrusion date remains undisclosed; the 8-K was filed on October 29, 2026.

What data was taken

Per the filing cited by The Record, the stolen information includes customer names, contact information, payment card numbers and card expiration dates. The data came from customers who had saved their payment information in their online shopping accounts. The Record notes the article does not mention whether card security codes (CVV) were exposed.

Who is affected

Revolve has not published a total figure. State regulators have received partial counts: Texas was told that 127,200 residents had information stolen, and Vermont filings listed 1,328 victims, according to The Record. Breach notifications were also filed in Massachusetts, though no count was given there. Because the exposed data includes payment card numbers and expiration dates, affected shoppers face an elevated risk of fraudulent charges and follow-on phishing. The Record names no threat actor, and the company has not attributed the attack.

What to do

Customers who saved a payment card to a Revolve account should watch card statements for unauthorized charges and consider asking their bank to reissue the card. Shoppers should be alert to phishing messages that reference recent orders or the breach, and avoid clicking links in unsolicited emails or texts. As a general precaution, removing stored card details from online retailer accounts limits what can be taken in a future breach.