October 29, 2026: Revolve Group, the online fashion retailer, told the SEC it had found unauthorised access to some of its systems. It says an intruder may have obtained names, contact information, payment card numbers and expiration dates for certain customers who saved payment details in their accounts. The company has not said how many customers were affected. Texas and Vermont filings list 127,200 and 1,328 people. The catalog entry records the filing.
What the company told the SEC
The company filed a Form 8-K on October 29, 2026, under Item 8.01, which covers other material events. It says it "recently became aware of unauthorized access to certain of its systems," that the activity was remediated, and that it has since added security measures. It notified federal law enforcement and hired outside cybersecurity specialists. It says the incident did not interrupt service to customers and does not believe it will have a material impact on the business.
What data is involved
The filing says an unauthorised actor "may have obtained, through automated means," the name, contact information, payment card number and card expiration date for certain customers. Those customers saved their payment information in their online shopping accounts. The filing lists these fields and does not mention security codes or passwords.
Notices and counts
- Texas: 127,200 people, per the state filing.
- Vermont: 1,328 people.
- Massachusetts: a breach notice was filed, but no count was reported.
- Total: not stated by the company.
Verified and unverified
- Confirmed by the company (SEC filing): unauthorised access to systems, the data fields above, notice to law enforcement, and no service interruption.
- From state filings: the Texas and Vermont counts.
- Unverified: when the access began or was detected; the total number of customers; how the data was taken; whether any cards have been used fraudulently; and whether other systems were involved beyond those the filing describes.
Who may be affected
Revolve customers who saved a payment card in their online account. The filing refers to "certain customers," so not every account is affected.
What to do
- Check your card statements for charges you do not recognise. If you are worried, contact your card issuer and ask for a replacement card.
- Card numbers and expiry dates can still be used for some online purchases, so turn on transaction alerts if your bank offers them.
- Be wary of emails or texts that mention Revolve, an order problem or a payment update. Go to the site by typing its address, not through a link.
- Change your Revolve password, and do not reuse it on other sites.
- Watch for a notice from Revolve confirming whether your account was involved.