Revolve says customer payment card data was stolen in breach

Online fashion retailer Revolve Group has notified customers that names, addresses and payment card numbers and expiry dates were stolen. The breach affected customers who had saved a card as a payment method in their Revolve account. Revolve has not said whether the card numbers were fully visible or masked, or whether the company or a third-party payment processor held them. Its SEC filing did not mention card verification value (CVV) codes.

The number affected nationwide remains unconfirmed. A Texas attorney general filing lists 127,200 affected Texans; data returned by the state website gives a total of 1,515,073, but that figure is not shown on its public listing. Revolve has not confirmed the larger number, and its SEC filing gives no total. The Texas records indicate the incident occurred on 11 September 2026 and was discovered on 29 September.

Revolve said an unauthorised actor may have obtained the data “through automated means”, but has not explained how access was gained. No group has publicly claimed responsibility.

Revolve said it had taken additional security measures but did not specify what they were. Customers with saved cards are advised to check statements for unfamiliar charges and report unauthorised transactions to their card issuer. They can also ask the issuer to cancel and replace a card. Revolve warned that stolen contact details could make scam calls, texts or emails about the breach more convincing.