Revolve says data breach exposed information of 1.5 million shoppers

Revolve, the online fashion retailer, told regulators that a September cyberattack affected 1,515,073 individuals. The Indiana Attorney General’s Office records show that Revolve became aware of the intrusion on 29 September, after the intruder accessed some of its systems, including the e-commerce platform, and may have used “automated means” to harvest customers’ names, mailing addresses and contact information, alongside card numbers and expiration dates.

The breach was first disclosed in late October in a filing with the U.S. Securities and Exchange Commission (SEC), with letters of notification to impacted customers beginning around the same time.

Revolve says the exposure was limited to shoppers who had stored a payment method in their online accounts. The company reported the attack to federal law enforcement and engaged external cybersecurity experts to assist with the response. As of the report, Revolve has not disclosed how the intruder gained access to its systems, and there has been no public claim of responsibility from any hacker group.

The regulatory disclosures stem from Revolve’s communications to Indiana, Iowa, Massachusetts, South Carolina, Texas, and Vermont, which together covered roughly 197,000 individuals prior to the latest update.