Revolve Data Breach: Saved Card Numbers Taken, What to Do

Revolve Group, the US online fashion retailer, has confirmed a data breach. In a Form 8-K filed with the SEC on 29 October 2026, Revolve says an unauthorized actor "may have obtained, through automated means," the name, contact information, payment card number and payment card expiration date of certain customers who saved payment information in their online shopping account. Revolve says the activity has been remediated. It has not said when the access happened or how many people were affected. If you saved a card with Revolve, check your statements and consider asking your bank for a new card.

Who this is for: Revolve customers, and the security, payments and compliance leaders at retailers who store cards on file.

Independent analysis based on Revolve's SEC filing and reporting by The Record. PlayCISO is not affiliated with Revolve. Facts are as reported on 30 October 2026 and may change.

What Revolve said

The disclosure is short. Revolve "recently became aware of unauthorized access to certain of its systems", "promptly initiated its cyber incident response protocols" and "confirmed the unauthorized activity was remediated." It "notified federal law enforcement authorities and engaged leading external cybersecurity experts." Based on its investigation, it believes the attacker may have obtained card data "for certain customers who saved payment information associated with their online shopping account on the Company's e-commerce platform." It says the incident "has not resulted in operational disruption or interrupted service to any customers" and that it does not believe it "will have a material impact on its business." The filing was signed by Chief Financial Officer Jesse Timmermans.

The phrase "through automated means" is the one detail about method, and Revolve has not explained it. Automated attacks on retail accounts often use scripts to log in with passwords leaked from other sites (credential stuffing) or to pull data at scale through an application interface. Neither has been confirmed here, so treat both as possibilities, not findings.

Timeline

If you are a Revolve customer

1. Check your card statements for the card you saved with Revolve, and keep checking for several months. Report anything you do not recognise to your card issuer.
2. Consider asking for a replacement card. The card number and expiry date may be in criminal hands. A new number ends that risk; monitoring only spots misuse after it happens.
3. Expect phishing. Names, emails and phone numbers were exposed too. Be wary of messages about a Revolve order, refund or "card verification", and do not give card details or one-time codes to anyone who contacts you.
4. Change your Revolve password, and change it anywhere else you used the same one. Revolve has not said passwords were involved, but it is a cheap precaution.
5. Watch for Revolve's notification letter. State filings mean notices are going out to affected customers.

What security leaders at retailers should do this week

• Ask where your full card numbers live. If customers can save cards, check whether full numbers are ever reachable from your own systems, or only tokens held by your payment provider. Full card numbers in your environment bring the systems that hold them into PCI DSS scope; tokens keep them out. See our PCI DSS gap analysis guide.
• Measure automated traffic on login and account pages. Know your baseline login failure rate and how you would spot a credential stuffing run. The Credential Stuffing Lab walks through the signals.
• Check what an account page reveals. Saved-card screens should show only the last four digits. Test whether any API behind them returns more.
• Know your notification clocks. Revolve was filing with state regulators within a day of its 8-K. Work out in advance which US state, card-brand and contract deadlines apply to you with the Breach Notification Clock Calculator.
• Decide who makes the materiality call. Revolve filed under Item 8.01, not Item 1.05, the item for incidents a company has determined to be material. If you are SEC-registered, rehearse that decision in the Materiality Call Lab before you need it.

FAQ

Was Revolve hacked?

Yes, according to Revolve. Its 29 October 2026 Form 8-K says it "recently became aware of unauthorized access to certain of its systems" and believes customer payment data may have been obtained through automated means. Revolve says the activity has been remediated.

What customer data was taken in the Revolve breach?

For certain customers who saved payment information, name, contact information, payment card number and payment card expiration date may have been obtained. The filing does not mention card security codes, passwords or other data.

How many people were affected by the Revolve data breach?

Revolve has not given a total. The Record reports 127,200 people in Texas and 1,328 in Vermont, based on Revolve's state filings, plus a filing in Massachusetts.

What should I do if I saved a card with Revolve?

Check statements, report unknown charges, consider a replacement card, and treat messages about Revolve orders or refunds with suspicion. Remove saved cards from accounts you no longer use.

When did the Revolve breach happen?

Revolve has not said. The filing says only that it "recently became aware" of the access, and The Record reports Revolve did not answer questions about timing.

Why did Revolve file an 8-K under Item 8.01 and not Item 1.05?

Item 1.05 is for cybersecurity incidents a company has determined to be material. Revolve says it does not expect a material impact, and filed under Item 8.01 (Other Events).

Sources

• Revolve Group, Inc.: Form 8-K, Item 8.01 (29 Oct 2026, SEC EDGAR)
• The Record: Fashion retailer Revolve says hackers stole payment card information (30 Oct 2026)

This article is general information, not legal or financial advice. Follow the instructions in any notification letter from Revolve and your card issuer.