⚑ Data breachNovember 10, 2026
Online fashion retailer Revolve told the SEC on October 29, 2026, that an unauthorized actor "may have obtained, through automated means" saved payment card details from certain customers. SecurityWeek reported that state filings show letters went to at least 197,072 people.
The short version
Company: Revolve Group
People affected: At least 197,072, per state filings reported by SecurityWeek
Data exposed: Name, contact information, card number, card expiration date
When it happened: September 11, per SecurityWeek
What's offered: No free credit monitoring, per SecurityWeek
What the company says happened
In its SEC filing dated October 29, 2026, Revolve Group said an unauthorized actor may have obtained certain customers' information through automated means. The filing says the affected customers had saved payment information to their online shopping account on Revolve's e-commerce platform. According to the filing, the company promptly started its incident response and confirmed the unauthorized activity was remediated. It also says Revolve notified federal law enforcement and hired outside cybersecurity experts.
The filing says the information may include a customer's name, contact information, card number and card expiration date. It does not mention card security codes. SecurityWeek reported the incident occurred September 11 and that notices filed with attorneys general in Iowa, Massachusetts, South Carolina, Texas and Vermont show letters went to at least 197,072 people. Malwarebytes reported that Texas attorney general data returned a total of 1,515,073 for Revolve; that figure is not shown on the public listing, and Malwarebytes says Revolve has not confirmed it.
What Revolve has and hasn't said
Revolve said in the filing that it does not expect a material impact on its business and that service was not disrupted. SecurityWeek reported that Revolve is not offering free identity theft or credit monitoring, and that it reminds people to review account statements and watch for fraud or identity theft. Revolve has not said who the attackers were or how they got in, according to the sources. Malwarebytes reported that no group has claimed responsibility.
What to do if you're a customer
Revolve says it is sending notices to affected customers and reminds people to review their account statements and watch for fraud or identity theft, SecurityWeek reported.
Malwarebytes, not Revolve, suggests checking statements line by line, reporting unauthorized charges to your card issuer, removing saved cards from shopping accounts, and asking the issuer for a new card number. It also advises distrusting unexpected calls, texts or emails about the incident.
Read the company's filing: Revolve's SEC filing.
As of the latest coverage, no lawsuit or expanded notice had been reported. The company's filing does not say how the unauthorized actor gained access.
Sources
Revolve Group: SEC filing, October 29, 2026
SecurityWeek: Revolve data breach impacts at least 180,000 people, November 2, 2026
Malwarebytes: Revolve card breach, 1.5 million people may be affected, November 3, 2026
This story is based on the records and reports linked above. Charges, lawsuits, and other accusations are claims, not findings of guilt or liability, unless the story says a court has ruled.
