United States | November 11, 2026

The Revolve data breach may have exposed saved payment-card information belonging to customers of the online fashion retailer, according to the company’s disclosure to US securities regulators. Separately, SecurityWeek reports that an Indiana regulatory notification puts the number of affected individuals at 1,515,073.

Revolve Group said an unauthorized actor may have obtained names, contact information, payment-card numbers and expiration dates for certain customers who saved payment information in their online shopping accounts. The company said the information may have been obtained through automated means, but it did not explain the technical method used to access its systems.

SecurityWeek reported that the intrusion occurred on September 11, 2026, and that Indiana records indicate Revolve became aware of it on September 29. Revolve’s securities filing, dated October 29, does not itself give those dates or a total number of affected people. NewsFlayer has not independently reviewed the Indiana filing behind the reported 1,515,073 figure.

The company says it remediated the unauthorized activity, engaged external cybersecurity experts and notified federal law enforcement. Customers who saved a card should review any notice, monitor their payment accounts and contact their card issuer through a trusted channel if they have concerns.

What Happened in the Revolve Data Breach?

Revolve Group disclosed unauthorized access to certain systems in a Form 8-K filed with the US Securities and Exchange Commission. The company said it activated its cyber incident response procedures after becoming aware of the activity, assessed the scope and implemented enhanced security measures.

Based on its investigation, Revolve said an unauthorized actor may have obtained names, contact information, payment-card numbers and expiration dates belonging to certain customers who had saved payment information with their online shopping accounts.

The company did not specify in the filing how the actor entered its systems or describe the precise collection mechanism. Its reference to “automated means” should not be treated as proof of a particular vulnerability, malicious checkout script or attack tool.

The Revolve data breach disclosure is serious because it concerns information that could be relevant to payment-card fraud. However, the company’s filing uses the qualified language “may have obtained.” It does not establish that every potentially affected card has been misused or that every customer experienced a financial loss.

How Many People Were Reportedly Affected?

SecurityWeek reported on November 9 that Revolve informed the Indiana Attorney General’s Office that 1,515,073 individuals were affected. The publication said earlier notices to several other state regulators covered approximately 197,000 people combined.

The reported Indiana figure provides a wider picture than the earlier set of state-specific notifications, but the figures should not simply be added together. The earlier state populations may be included within the larger total, and adding them without a clear basis could double-count affected people.

The Revolve data breach Form 8-K does not state a total. NewsFlayer has not independently accessed the Indiana notification and therefore attributes the figure to SecurityWeek’s reporting rather than describing it as independently verified from the regulator.

Malwarebytes separately reported that data returned by the Texas attorney general’s site contained the same total, although the figure was not displayed on the public listing it reviewed. That additional report does not replace direct verification of the Indiana record or prove that all affected people experienced fraud.

What Information May Have Been Involved?

The Revolve data breach filing identifies four categories potentially obtained for certain customers with saved payment information:

• Name.
• Contact information.
• Payment-card number.
• Payment-card expiration date.

SecurityWeek reports that contact information included mailing addresses. The company’s disclosure does not say that every Revolve shopper had a card exposed. Its description concerns certain customers who saved payment information to online shopping accounts.

The Form 8-K does not mention card security codes, account passwords or Social Security numbers. An omission is not the same as a confirmed statement that those details were unaffected. There is also no evidence that they were taken. Customers should consult their individual notices and later official updates for details specific to their circumstances.

The company did not specify in the filing whether card numbers were masked or fully visible, or identify the precise system in which the information was stored. Avoid assuming either detail without supporting evidence.

Timeline and Company Response

SecurityWeek reported that unauthorized access occurred on September 11 and that Indiana regulatory records show Revolve became aware of the incident on September 29. Those dates are attributed to the publication’s reporting on the available records, not to Revolve’s SEC filing.

On October 29, Revolve dated its Form 8-K describing the incident. The company said it had promptly initiated response procedures, confirmed that the unauthorized activity was remediated, involved external cybersecurity experts and notified federal law enforcement.

The company also said the incident had not disrupted operations or interrupted customer service and that, as of the filing date, it did not believe the event would have a material impact on its business. That business assessment is not a determination that customers face no risk or that no unauthorized payment could occur.

On November 9, SecurityWeek reported the 1,515,073 figure attributed to the Indiana notification. Revolve’s earlier SEC filing did not include this number. The company’s statements and regulatory reports should be checked again for any later updates before publication.

Seven Critical Risks for Affected Shoppers

These are potential consequences of exposed contact or payment information. They are not outcomes confirmed for every person included in the Revolve data breach.

1. Unauthorized card transactions: A card number and expiration date can be useful to a fraudster. Affected customers should review transactions and contact their issuer about appropriate protective action.
2. Small test charges: Fraudsters sometimes try small transactions before attempting larger ones. An unfamiliar small charge deserves attention, though it is not automatically attributable to this incident.
3. Impersonated breach notices: Someone may pose as the retailer or a bank to request a card number or verification code. Verify the sender through a trusted channel rather than an unsolicited link.
4. Targeted phishing: Names, contact details or mailing addresses can make a fraudulent communication appear more credible. Familiar personal information does not prove that a message is genuine.
5. Repeated exposure of saved payment methods: A customer may have saved a card on multiple services. Removing unnecessary stored payment details can reduce future exposure, but does not undo information already obtained.
6. Account-security concerns: An incident can prompt attempts to impersonate customers or target their accounts. Revolve’s filing does not establish that account passwords were taken, so do not present password theft as a confirmed fact.
7. Time and disruption during response: Replacing a card or disputing transactions can affect subscriptions and scheduled payments. The actual effect depends on the customer’s circumstances and issuer’s procedures.

These possibilities do not prove that any specific customer has suffered fraud. A person should use their own notice, account statements and card issuer’s advice to determine which actions are appropriate.

What Should Revolve Customers Do?

Verify any notification

Read any notice carefully to understand which information may be involved. If a message asks for a full card number, security code, password or one-time verification code, do not provide it through an unsolicited link or call. Independently locate the retailer’s official website or a known customer-service channel to confirm the communication.

Not every customer may receive the same notice, and the absence of a notice should not be treated as proof of exposure or non-exposure. People who saved payment information and are concerned can contact the company directly through a trusted channel.

Contact the card issuer

After the Revolve data breach, review recent and future card statements for unfamiliar transactions. If you saved a payment card with Revolve or received a notice indicating that a card may have been involved, contact the issuing bank using the number on the back of the card or its official app.

Ask whether the issuer recommends replacing the card, changing the account number or taking another protective step. Enable transaction alerts if available. Promptly dispute unauthorized charges and follow the issuer’s instructions; do not wait for a large transaction before reporting an unfamiliar charge.

Replacing a card can require updating legitimate subscriptions or recurring payments. Keep a record of communications with the issuer and check subsequent statements for any continuing issues.

Review saved information and accounts

Consider removing payment methods that no longer need to be stored in shopping accounts. Use unique passwords and multi-factor authentication where available. These are general security practices; the company’s Form 8-K does not say passwords were involved in the Revolve data breach.

If you accidentally shared a password or one-time code with an impostor, contact the relevant service provider immediately and follow its account-recovery instructions. If a card number was supplied to a suspicious party, contact the issuer promptly.

What Remains Unknown?

The Revolve data breach filing does not identify the initial access route, a specific vulnerability, the attacker’s identity or the exact tools used. Its reference to possible automated collection is not enough to conclude that any particular payment skimmer or malware family was involved.

The filing also does not provide a nationwide count, confirm whether card security codes were affected or state whether every card number was fully visible. SecurityWeek’s reported total comes from its account of an Indiana notification, which NewsFlayer has not independently reviewed.

The public material reviewed does not establish that every potentially affected customer was a victim of payment fraud or that all saved-card users were affected. Later notices or investigation findings may clarify the scope.

Why Saved Payment Information Matters

Saving a card can make online shopping more convenient, but it also creates another place where payment information may be accessible. A retailer’s responsibility to safeguard that information remains important regardless of whether a shopper chooses a convenient checkout option.

A security incident involving stored card data is different from proof that a payment has been made. Card networks and issuers may have fraud controls, and customers can help by reporting unfamiliar transactions quickly. Those controls reduce risk but do not remove the need to review account activity.

For retailers, the incident illustrates the importance of knowing where sensitive information resides, limiting access and preparing to notify customers. Revolve has not disclosed the technical cause, so this general lesson should not be presented as a finding that a specific security control failed in its environment.

Conclusion

Revolve says an unauthorized actor may have obtained contact and saved payment-card information for certain online shoppers. SecurityWeek reports that a notification to Indiana regulators puts the affected population at 1,515,073; NewsFlayer has not independently reviewed that filing.

Customers should verify any breach communication, monitor their accounts and ask their card issuers whether replacement or other precautions are appropriate. The absence of a confirmed fraud count does not mean customers must wait for an unauthorized charge before taking action.

Source note: This report draws on Revolve Group’s SEC Form 8-K and reporting by SecurityWeek and Malwarebytes. The reported Indiana total was not independently checked against the regulator’s original notification.

NewsFlayer — Bringing You the Latest Cybersecurity News from Around the World.