Revolve data breach: saved payment cards may be exposed

We publish these pages from public notices and reporting so you can understand what was exposed. Everything here is already public. Always confirm with the organization named in your notice.

Revolve Group, the online fashion retailer, told investors on October 29, 2026 that someone gained unauthorized access to some of its systems and may have taken payment card details for customers who had saved a card to their account. The company says the activity has been remediated and that it does not expect a material impact on its business. It has not said how many customers are affected or when the access happened.

What happened

Revolve disclosed the incident in a Form 8-K filed with the U.S. Securities and Exchange Commission, dated October 29, 2026. The filing was made under Item 8.01 (Other Events) rather than the item used for incidents a company has judged material.

In the filing, Revolve says: "The Company recently became aware of unauthorized access to certain of its systems. The Company promptly initiated its cyber incident response protocols and confirmed the unauthorized activity was remediated." It adds that it notified federal law enforcement and engaged outside cybersecurity experts. (Confirmed)

The company also states that the incident "has not resulted in operational disruption or interrupted service to any customers." (Confirmed)

The Record, a cybersecurity news outlet, reported the filing and noted that Revolve did not say when the attack took place. (Reported)

What data was involved

The filing describes the data this way: "An unauthorized actor may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information." (Confirmed)

What that means in practice:

• Who is in scope: customers who stored a payment card on Revolve's e-commerce platform. Shoppers who did not save a card are not described as affected. (Confirmed)
• Data types: name, contact information, card number and card expiration date. (Confirmed)
• What is not stated: the filing does not mention card security codes, passwords, Social Security numbers or dates of birth, and it does not give a count of affected customers. (Confirmed, by omission in the filing)
• "May have": Revolve's language describes possible access, not confirmed theft of every record. Some headlines describe the card data as stolen; the filing itself says "may have obtained." (Confirmed vs Reported)

Because the exposed fields are contact and payment details rather than home address history, birth dates or government ID numbers, this incident is mainly a card-fraud and phishing risk rather than an identity-theft or open-web exposure risk.

What affected customers can do now

If you have shopped at Revolve and saved a card to your account:

1. Check your card statements. Look over recent transactions on any card saved to your Revolve account, including small charges, which are sometimes used to test stolen card numbers.
2. Ask your card issuer about a replacement card. Calling the number on the back of your card and asking for a new card number closes off use of the old one. If you see a charge you do not recognize, dispute it with the issuer.
3. Set up transaction alerts. Most banks and card issuers can send a text or app notification for every purchase, which helps you spot misuse quickly.
4. Expect targeted phishing. With names and contact information in the mix, scammers may send emails or texts that look like they come from Revolve or your bank, sometimes quoting part of your card number. Do not click links or share codes from unexpected messages. Go to Revolve's website or app directly, or call your bank using the number on your card.
5. Review your saved payment methods. Sign in to your Revolve account through the official site or app and remove or update cards you no longer want stored.
6. Watch for a direct notice. The 8-K does not say whether Revolve will contact affected customers individually. If it does, compare any letter or email against the company's official channels before acting on it.

A card number and expiration date on their own cannot be used to open new credit in your name, so a credit freeze is not specifically called for by the data Revolve has listed. It remains a free, reasonable step if you want broader protection.