Skip to content
Breach Index · running record

Revolve data breach (October 2026): what Revolve’s 8-K says

In October 2026 Revolve Group, the online fashion retailer, disclosed that customers’ saved payment card details may have been taken.

Short answer

Was Revolve hacked?

Yes. Revolve’s Form 8-K of 29 October 2026 says an unauthorized actor “may have obtained, through automated means,” the names, contact details, payment card numbers and expiry dates of certain customers who saved payment information in their accounts.

Revolve says the activity was remediated and it does not expect a material impact. It has not given a total; The Record reports 127,200 Texans and 1,328 Vermonters per state filings.

Timeline at a glance

  1. 29 Oct 20268-K: saved card numbers and expiry dates may have been taken. (SEC 8-K)Confirmed
  2. 30 Oct 2026State filings: 127,200 Texans, 1,328 Vermonters. (The Record)Reported

Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Revolve Group’s security posture at the time

What Revolve Group publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.

Security certifications publicly held

No public certification found.

No public certification found on the company’s own security, trust or compliance pages, in filings, or in the certificate registries searched (BSI, CSA STAR). That is a data point, not proof that none exists.

Size

Revenue $1.23 billion, FY2025 (calendar year). Revolve Q4 and full-year 2025 results

Listing: NYSE: RVLV

Share price around the disclosure

No reliable report of a share-price move around the disclosure was found.

Revolve Group incident timeline, in detail

Confirmed = acknowledged by Revolve Group, a regulator filing or a court. Reported = credible reporting Revolve Group has not fully confirmed. Unverified claim = an attacker or leak-site claim.

29 Oct 2026ConfirmedAccount / payment data

Saved payment cards obtained through automated means

What happened. Revolve’s Form 8-K says an unauthorized actor “may have obtained, through automated means,” the names, contact details, payment card numbers and expiry dates of certain customers who saved payment information in their accounts. Revolve says the activity was remediated and it does not expect a material impact.

Impact. Customers who saved a card should watch statements and consider a replacement card. People or records affected: Not disclosed in total. The Record reports 127,200 Texans and 1,328 Vermonters per state filings.

Sources: Revolve Group Form 8-K, 29 Oct 2026 · The Record — Revolve breach

The pattern across the record

Certified, and still breached?

We found no SOC 2 or ISO 27001 certification published by Revolve Group. That does not prove it had none; it means none was public.

A direct intrusion

The company describes unauthorized access to its own systems. The useful questions are how long the access lasted, how it was detected, and whether the affected system was inside the scope any certification covered.

What it means for Revolve Group Revolve and FWRD customers — and what to do

What Revolve Group’s customers, partners and security teams can do now, based only on what has been disclosed.

  1. 1.Ask what was in scope

    Ask which systems were reached, what data of yours they held and the dates of access.

    Open the Third-Party Breach Intake
  2. 2.Watch for notification letters

    Affected individuals are usually notified by letter or email; genuine notices do not ask for passwords or payment details.

  3. 3.Estimate your exposure

    If you are a business customer, estimate what an incident at this supplier could cost you.

    Open the breach-cost estimator

CISO takeaways

Revolve data breach: saved card numbers taken

Our news write-up of this incident: what was confirmed, the timeline and what to do this week.

Read the news post
Read the scope, not the badge

Ask for the SOC 2 system description or ISO 27001 statement of applicability, and check the system you care about is in it.

Score a vendor
Price the risk you still carry

Certification does not transfer liability. Model what an incident would cost and whether insurance covers it.

Open the cyber insurance tool
Rehearse the vendor call

Most 2026 incidents reached customers through a supplier. Practise the first questions you would ask.

Open the Vendor Breach Lab

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed October 31, 2026.

  1. 1.Revolve Group Form 8-K, 29 Oct 2026 — SEC EDGAR, reviewed 31 Oct 2026
  2. 2.The Record — Revolve breach — The Record, reviewed 31 Oct 2026
  3. 3.Revolve Q4 and full-year 2025 results — s203.q4cdn.com, reviewed 31 Oct 2026

Frequently asked questions

Was Revolve hacked?

Yes. Revolve’s Form 8-K of 29 October 2026 says an unauthorized actor “may have obtained, through automated means,” the names, contact details, payment card numbers and expiry dates of certain customers who saved payment information in their accounts.

Did Revolve Group have SOC 2 or ISO 27001 certification?

We found no SOC 2 or ISO 27001 certification published by Revolve Group. That does not prove it had none; it means none was public.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coca-Cola (fairlife) data breachConsumer and retail

fairlife ransomware halts US production.

Match Group data breachConsumer and retail

Tinder, Hinge, OkCupid and a vishing wave.

Bumble data breachConsumer and retail

A phished contractor account.

Panera Bread data breachConsumer and retail

~5.1M accounts and an SSO claim.

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Revolve Group. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout