Revolve Breach Potentially Exposes Saved Payment Cards of 1.5 Million Customers

Online fashion retailer Revolve Group disclosed a breach potentially exposing saved payment information belonging to 1,515,073 individuals, according to state filings. Attackers accessed multiple company systems and used automated means to obtain information associated with customers who stored payment details in their shopping accounts. Potentially exposed data includes names, contact information, payment card numbers and expiration dates; Revolve has not clarified whether the card numbers were complete or masked. Texas records place the unauthorized activity on September 11, 2026, and discovery on September 29. The company disclosed the incident in an October 29 SEC filing.

Revolve said it remediated the unauthorized activity, engaged outside cybersecurity specialists, notified federal law enforcement and implemented additional security measures. The company reported no operational disruption and does not anticipate a material business or financial impact. The attacker and precise access method remain unidentified; the reported use of automation does not establish how the systems were compromised. Affected customers should monitor payment accounts for unauthorized transactions and contact their card issuers about protective measures.