Revolve saved-card breach may affect 1.5 million shoppers
Revolve says an attacker may have obtained shoppers’ saved card numbers, expiry dates and contact details. A filing tracker puts the potential total at 1.5 million. Check your breach notice, review transactions and contact your card issuer.
If you saved a card with Revolve or FWRD, check your breach notice for the affected card’s last four digits and review its transactions. Call your card issuer using the number on the card to discuss the exposure and whether replacement is appropriate; report any unauthorised charges immediately.
What’s happening
Revolve Group, which operates Revolve.com and FWRD.com, says an attacker accessed its shopping platform on 11 September 2026. Customers who saved payment information in their accounts may have had their names, addresses, card numbers and expiry dates taken. Filing tracker AcidPeak attributes a potential total of 1,515,073 affected people to Revolve’s Texas notification; that total could not be independently checked in the accessible regulator listing. SecurityWeek separately counted 197,072 notification recipients across several states, a subtotal rather than an overall figure. Revolve says it stopped the unauthorised activity, notified law enforcement and strengthened security. This is a breach with no customer software update to install. The sources reviewed do not establish whether exposed cards have subsequently been used fraudulently.
- What
- Breach
- Affects
- Revolve and FWRD online shopping accounts with saved payment cards
- Fixed in
- Nothing to patch
- Since
- 29 Oct 2026
Timeline
- Update
Filing tracker AcidPeak lists 1,515,073 people potentially affected overall and 127,200 Texas residents, attributing both figures to Revolve’s Texas notification.
- Made publicNothing to patch
Revolve disclosed the breach in an SEC filing, identifying customers who saved payment information in their shopping accounts. It said it had stopped the unauthorised activity and brought in external cybersecurity specialists.
- Update
Revolve determined that the information involved included customers’ names, addresses, payment card numbers and expiry dates.
- Update
An attacker accessed Revolve Group’s shopping platform and may have obtained customer information, according to the company’s subsequent breach notice.
Sources
- Revolve Group customer notice of data breachRevolve Group · 29 Oct 2026
- Revolve Group Form 8-K: unauthorised access to company systemsRevolve Group · 29 Oct 2026
- Fashion retailer Revolve says hackers stole payment card informationThe Record · 30 Oct 2026
- Revolve Data Breach Impacts at Least 200,000 PeopleSecurityWeek · 3 Nov 2026
- Revolve Group, Inc. data breach notices, Oct 29, 2026 to Oct 30, 2026AcidPeak · 30 Oct 2026