Revolve Data Breach: Saved Payment Cards May Have Been Taken, and What Online Stores Should Check

Online fashion retailer Revolve says someone got into some of its systems. That person may have used automated means to collect the names, contact details, card numbers and card expiration dates of customers who had saved a card to their account. If you shop there, check your card statements now. If you run an online store that keeps saved cards, this is a good week to find out where those card numbers are stored and who can get to them.

What Revolve has confirmed

Revolve Group filed a Form 8-K with the U.S. Securities and Exchange Commission dated October 29, 2026. The disclosure is under Item 8.01 (Other Events). The company says:

• It "recently became aware of unauthorized access to certain of its systems."
• It started its incident response process and says the unauthorized activity was remediated.
• "An unauthorized actor may have obtained, through automated means," the name, contact information, payment card number and card expiration date of certain customers who saved payment information to their online shopping accounts.
• It notified federal law enforcement, brought in outside cybersecurity experts and is adding security measures meant to stop a similar event.
• Customers saw no outage or service disruption, and the company does not currently expect a material impact on its business.

The Vermont Attorney General's security breach notice list shows a Revolve Group, Inc. filing reported on October 29, 2026. It lists 1,328 Vermont residents affected, with the data categories "Financial Account Codes, Credit and Debit Account Info."

Note the wording. Revolve says the data may have been obtained. It does not say every saved card was confirmed stolen, and it does not say the cards have been misused.

What is reported but not confirmed by Revolve

These points come from news coverage of state filings, not from anything Revolve has published:

• How many people. Revolve has not given a total. SecurityWeek added up notices filed in Iowa, Massachusetts, South Carolina, Texas and Vermont and counted at least 197,072 people. The first reports said about 180,000, before more state filings came in. Of those state filings, we opened only Vermont's ourselves.
• When it happened. SecurityWeek reports, citing the state filings, that the incident took place on September 11, 2026. That date is not in the 8-K.
• Credit monitoring. SecurityWeek reports that Revolve is not offering free credit or identity monitoring and is advising people to watch their statements.

What is not known

• How the attacker got in, and who it was. Revolve has not said.
• What "automated means" refers to. The phrase points to a script or tool rather than someone clicking through pages by hand. Revolve has not said whether that involved stolen customer passwords, a flaw in the website, or access to a back-end system.
• Whether card security codes (CVV) were involved. The filing lists card number and expiration date and does not mention security codes. That is not the same as Revolve saying the codes were safe.
• Whether the count will grow. More state notices may still be filed.

If you shop at Revolve: what to do now

• Check recent statements on any card saved to your Revolve account. Small test charges are a common first sign of misuse.
• Call your card issuer and ask for a replacement card number. Issuers handle this routinely, and it stops a leaked number from working.
• Treat any email, text or call about the breach with caution. Your name and contact details may be in the same data, so expect phishing that claims to be from Revolve or your bank. Use the number on the back of your card, not one from a message.
• If you used your Revolve password anywhere else, change it on those sites. The filing does not list passwords, but reused passwords are always worth fixing.
• If you shop online often, think about using a digital wallet or a virtual card number instead of saving your actual card number.

Why this matters for an online store

Saved cards help sales because customers check out in one click. They also put a pile of valuable data in one place. The key question for any online store is who actually holds the card number.

Most modern payment processors offer tokenization. The processor stores the card, and your website keeps only a token that works with your merchant account and nowhere else. If a thief steals tokens, they cannot use them at another shop. If your own database holds full card numbers, a breach of your site exposes the cards directly. You also take on the heaviest part of PCI DSS, the card industry's security standard.

The "automated means" wording matters too. Bots work through login pages, account pages and APIs around the clock. If a customer account page or API returns more card detail than the customer needs to see, a script can collect it at scale.

What to check this week

For more on checkout scripts, see how a hijacked monitoring script drained traders in the Polymarket case. If your store runs on WordPress with WooCommerce, our post on why WordPress sites get hacked covers the plugin and login risks.

Revolve data breach questions people are asking

Was my card stolen in the Revolve breach?

Only if you saved a card to your Revolve account. Even then, Revolve says the data may have been obtained, not that it definitely was. Revolve has been mailing notice letters, so watch your mail and your statements.

What information was exposed in the Revolve hack?

According to the SEC filing: name, contact information, payment card number and card expiration date, for customers who saved payment information. The filing does not mention passwords or card security codes.

How many people were affected by the Revolve data breach?

Revolve has not said. Counts from state filings add up to at least 197,072 people, according to SecurityWeek. Vermont's own list shows 1,328 Vermont residents.

Is Revolve offering free credit monitoring?

SecurityWeek reports it is not. Revolve is advising customers to check their account statements for fraud.

Should I cancel my card?

Asking your issuer for a new card number is the simplest protection, and it costs you nothing. If you would rather keep the card, set up transaction alerts and check every charge.

Is it safe to shop at Revolve now?

Revolve says the activity has been remediated and new safeguards added. No one outside the company can confirm that yet. For now, check out without saving your card, or use a digital wallet.

The bigger lesson

Attackers cannot steal a card number you never stored. Let your payment processor hold the cards, show customers only the last four digits, and assume bots are testing every login and account page you run. Then check your setup on a schedule, not only after a breach makes the news.

Want someone to check how your store handles payment data? See our security hardening services or request a tech quote.

Get security alerts like this by email, plus our free checklist, at EPE Security Alerts.

Sources: Revolve Group Form 8-K, SEC; Vermont Attorney General security breach notices; SecurityWeek.