Revolve Says Data Breach Exposed Information of 180,000 Customers

Online fashion retailer Revolve has disclosed a data breach that exposed personal and payment card information for at least 180,000 customers. The incident occurred on 11 September and involved unauthorised access to Revolve’s online shopping platform and related systems. Revolve says the attackers may have accessed and exfiltrated names, addresses, payment card numbers, and card expiration dates of customers who saved data to their Revolve accounts.

Revolve reports it acted quickly to contain and remediate the breach, engaging a cybersecurity firm and notifying law enforcement. The company has begun notifying potentially affected individuals, with notices filed in Iowa, Massachusetts, Texas, and Vermont indicating at least 179,259 people received letters. Revolve states there was no operational disruption or service interruption for customers, and it does not anticipate a material impact on its business.

The retailer has not disclosed how many individuals remain impacted or who carried out the attack, and SecurityWeek has said it has sought additional information from Revolve.

Affected individuals are not being offered free identity theft or credit monitoring by Revolve; instead, they are advised to review account statements and stay vigilant for fraud. The company emphasised that, as of its filing with the US Securities and Exchange Commission, it does not expect a material business impact, though the incident is being investigated further. No specific exploit details or methods were provided.