Revolve breach: saved payment card numbers and expiry dates may have been taken, at least 179,259 people notified

What happened

Revolve Group, the online fashion retailer behind Revolve and FWRD, disclosed in a Form 8-K filed with the US Securities and Exchange Commission on October 29, 2026 that it had recently become aware of unauthorized access to certain of its systems. The company says it promptly initiated its incident response protocols, confirmed the unauthorized activity was remediated, implemented enhanced security measures, notified federal law enforcement and engaged external cybersecurity experts. Based on its investigation, the company believes an unauthorized actor may have obtained, through automated means, customer data held on its e-commerce platform. Notification letters filed with state attorneys general say the incident occurred on September 11, 2026, SecurityWeek reported on November 2, and the company began notifying potentially affected individuals in the week before that report; notices filed in Iowa, Massachusetts, Texas and Vermont account for at least 179,259 people notified. Revolve has not given a total affected count, has not identified who was behind the access, and the incident caused no operational disruption, the company says. The filing also says the company does not believe the incident will have a material impact on its business, while cautioning that its assessment of the incident is still under way and its conclusions could change as that review continues — which is why the count in the state filings, rather than a company total, is the only scope figure available so far.

Who is affected

Revolve customers who saved payment information associated with their online shopping account on the company’s e-commerce platform. For those customers, the company believes the actor may have obtained their name, contact information, payment card number and payment card expiration date; the letters filed with state regulators describe the contact information as including the customer’s address. The company has not published a total count — the at least 179,259 people in the four states’ filings are a floor, not the full scope — and it is not providing free identity theft or credit monitoring services, SecurityWeek reported.

How serious

The concrete risk is payment card fraud. A card number and expiration date paired with the cardholder’s name and address is the set a fraudster needs to attempt card-not-present purchases at merchants that do not demand the security code — and the 8-K lists no security code among the data, which limits but does not remove that risk, because not every merchant checks it. The same name-and-contact set also supports targeted phishing: a message that quotes your real name, address and the retailer you shop with is far easier to believe than a generic lure, and Revolve itself reminds affected customers to review their account statements and remain vigilant for fraud or identity theft.

What to do now

If you saved a card in a Revolve or FWRD account, review that card’s statements back to September 2026 for charges you do not recognise and report anything unfamiliar to the card issuer immediately — the issuer’s number is on the back of the card, not in any message about the breach. Ask the issuer whether it will replace the card; a new number closes the risk from this incident in a way monitoring cannot. Remove or update the saved card in your shopping account, and treat any email, text or call about the breach that asks you to sign in, confirm card details or pay a fee as a scam: check your account only through the retailer’s official site or app, which you open yourself. Revolve is not offering credit monitoring for this incident, so your own statement checks are the early-warning system.

Sources: Revolve Group, Inc., Form 8-K, US Securities and Exchange Commission, October 29, 2026 · SecurityWeek, November 2, 2026