Short answer
Revolve said in an 8-K filing dated 29 October 2026 that an unauthorized actor may have used automated means to obtain names, contact details, card numbers and expiry dates from customers who saved payment details in their accounts. SecurityWeek, citing state filings, puts the incident date at 11 September.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Revolve Group, Inc. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Online fashion retail |
| Country | United States |
| Detected | 2026-09-11 |
| Disclosed | 2026-10-29 |
| People or records affected | At least 197,072 people across state attorney general filings (Texas 127,200, Vermont 1,328, South Carolina 17,813, plus Iowa and Massachusetts); Revolve has not given a total |
What data was exposed
- Names and contact information
- Payment card numbers and expiration dates saved to online shopping accounts
What happened
Revolve is an online fashion retailer. On 29 October 2026 it filed a Form 8-K with the US Securities and Exchange Commission saying it had become aware of unauthorized access to certain of its systems. The company started its incident response process, said the activity was remediated, and told the SEC it had notified federal law enforcement and hired outside cybersecurity experts.
The filing says the incident caused no operational disruption and that Revolve does not currently expect a material effect on its business.
What was taken
According to the filing, an unauthorized actor may have used “automated means” to collect names, contact information, payment card numbers and card expiration dates. Only customers who had saved payment information to their online accounts are described as affected. A card entered at checkout without saving it is not mentioned in the filing.
Revolve did not say how the attackers got in, and has not named them. The Record asked the company questions about timing and received no reply.
How many people
The 8-K gives no total. State notices fill part of the gap. The Record reported 127,200 people in Texas and 1,328 in Vermont. SecurityWeek, updating its story on 3 November, counted at least 197,072 people across filings in Iowa, Massachusetts, South Carolina, Texas and Vermont, including 17,813 in South Carolina. Notification letters began going out the week before 2 November.
SecurityWeek says Revolve is not offering free credit or identity monitoring, which means the practical protection is on the card side: your issuer can cancel and reissue a card within a day.
Why saved cards matter
Saved cards are a common target because a stolen number plus expiry date is enough to attempt purchases on many sites. The security code is not listed among the exposed fields in Revolve’s filing, but some merchants do not require it. That is why issuers advise replacing the card, not just watching it.
What to do
If you ever saved a card on a Revolve account, ask your bank to replace it, delete saved cards from the site, and turn on transaction alerts. Review statements back to September. Expect scam messages that use news of the breach as bait, and read our guide to phishing messages and our data breach checklist for the steps that apply to any letter you receive. If shopping sites you use are asking for card details by link, see online shopping scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fraudulent charges made with stolen card numbers, often small test purchases first.
- Fake 'Revolve security alert' emails or texts that ask you to confirm card details through a link.
- Calls from someone posing as your bank who already knows part of your card number and asks you to 'verify' the rest.
What to do if you are affected
- 01Check card statements for charges you do not recognize, starting with any card you saved on Revolve, and report them to your card issuer.
- 02Ask your card issuer to replace the card if you saved it on Revolve, and remove saved cards from the site.
- 03Turn on transaction alerts for the card so you see every charge in real time.
- 04Treat any message about this breach that asks for card details as phishing and go to the company site by typing the address yourself.
- 05Place a fraud alert or credit freeze if you also received a letter that mentions other personal data.
Frequently asked questions
What did Revolve say was taken?
Revolve's filing says an unauthorized actor may have used automated means to obtain names, contact information, payment card numbers and card expiration dates. It applies to customers who saved payment information to their online shopping accounts.
How many people are affected?
Revolve has not published a total. State attorney general filings reported by SecurityWeek add up to at least 197,072 people. Estimates elsewhere are higher, and the figures have not been reconciled.
Is Revolve offering credit monitoring?
SecurityWeek reported that Revolve is not offering free identity theft or credit monitoring. The letters advise customers to review account statements and watch for fraud.
When did the attack happen?
The 8-K does not give a date and says only that Revolve recently became aware of the access. SecurityWeek, citing the notification filings, gives 11 September 2026 as the incident date.
Sources
- Form 8-K, Item 8.01 (Other Events), Revolve Group, Inc. via SEC EDGAR, 2026-10-29
- Fashion retailer Revolve says hackers stole payment card information, The Record, 2026-10-30
- Revolve data breach impacts at least 180,000 people, SecurityWeek, 2026-11-02
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.