NewsCompaniesFlawsGuides
Get the app

Revolve payment-card breach may affect 1.5 million shoppers

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.
The source, on d18rn0p25nwr6d.cloudfront.net
Screenshot: d18rn0p25nwr6d.cloudfront.net

Revolve says an attacker may have obtained personal and payment information belonging to customers who saved cards in their shopping accounts. Malwarebytes reports a possible total of 1,515,073 people, which Revolve has not confirmed. The company says it stopped the unauthorised activity and brought in outside cybersecurity experts.

Revolve says customers’ saved payment-card details may have been taken. Check your notice and card transactions, and ask your bank about a replacement.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

If you saved a payment card in your Revolve shopping account, check your breach notice and bank transactions. The retailer says an attacker may have obtained customers’ names, contact details, card numbers and expiry dates. Its 29 October filing[1] describes information saved for future purchases.

Revolve’s customer notice[2] dates the unauthorised access to 11 September 2026. On 29 September, the company determined which personal and card information was involved. It says it contained the activity and notified law enforcement.

Revolve card breachSaved payment information
HARD assessment
High Potential exposure of payment-card details
Customers concerned
Certain customers who saved payment information in their shopping accounts
Information listed
Names, contact details, card numbers and expiry dates
Reported scale
Possibly 1,515,073 people; total unconfirmed by Revolve
What’s known.Revolve’s company filing[1] and Malwarebytes’ reporting[3].

Timeline

  1. HARD publishes its article, at High.

Who is affected

The disclosed scope is customers who saved payment information, rather than everyone who has ever bought something from the retailer. Revolve Group operates Revolve.com and FWRD.com, both named in its customer notice. The sample letter identifies the affected card by its last four digits, so use your own notice to work out which card needs attention. Read Revolve’s sample notice[2].

Neither the company filing nor that notice lists card security codes, known as CVVs, among the information involved. That leaves their exposure unconfirmed; it is not a reason to ignore the notice. Revolve advises recipients to check statements and immediately report unauthorised charges to their card issuer.

What the 1.5 million figure means

The Record reported[4] 127,200 affected Texans on 30 October. Malwarebytes later found 1,515,073 labelled as the total affected in data returned by the Texas reporting site. It says that larger figure is absent from the public listing and unconfirmed by Revolve. Treat it as a reported possible total. Malwarebytes explains the distinction[3].

What to do this week

  1. Identify the card.Read your notice and match its last four digits to your cards. If you saved payment details but are unsure whether you are affected, contact Revolve through its website.
  2. Check transactions now, then keep checking.Review recent payments in your bank’s official app, including small amounts. Help parents who shop there review theirs. Report anything you cannot account for immediately and keep the bank’s reference number. Moneysmart explains how to report unfamiliar transactions[5].
  3. Ask about a replacement number.Tell your card issuer the card may have been exposed and ask whether it should be cancelled and replaced. Malwarebytes recommends requesting a new card number[3].
  4. Verify anyone who contacts you.Do not follow unexpected banking links or give callers your passwords or one-time codes. Hang up and call the number printed on your card. Knowing your name or other personal details does not prove a caller is genuine. Moneysmart’s banking-scam guidance[6].

References

  1. ^ Revolve Group (). “Revolve Group Form 8-K, 29 October 2026”. Primary disclosure of potential saved-card exposure, affected customer category and incident response.
  2. ^ Revolve Group / California Attorney General. “Revolve customer notice filed with the California Attorney General”. Undated sample letter establishes incident dates, data involved, card identification and customer advice.
  3. ^ Malwarebytes (). “Revolve card breach: 1.5 million people may be affected”. Explains the unconfirmed total from Texas site data and recommends replacement card numbers.
  4. ^ The Record (). “Fashion retailer Revolve says hackers stole payment card information”. Reports the disclosure and 127,200 affected Texas residents.
  5. ^ ASIC Moneysmart (). “Bank transaction problems”. Australian guidance on checking transactions, reporting promptly and keeping a reference number.
  6. ^ ASIC Moneysmart (). “Banking scams”. Guidance on bank impersonation, personal details, suspicious links and independently calling back.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.