Threat watch / Breach
Revolve: saved payment cards stolen from the online fashion retailer
US online fashion retailer Revolve told the SEC on October 29 that hackers gained access to multiple company systems and, "through automated means", took names, contact details, card numbers and expiry dates of customers who had saved a card. It told Texas regulators that 127,200 people in the state were affected; Malwarebytes found a total of 1,515,073 in the state portal's data, a figure Revolve has not confirmed.
- Sector
- Retail
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- Not public yet Checked 9 Nov 2026
- What was stolen
- Names, contact information, payment card numbers and card expiration dates of customers who saved payment information. The filing does not mention security codes; Malwarebytes notes it is unclear whether card numbers were fully visible or masked.[1][2] Checked 9 Nov 2026
- Who was impacted
- Revolve customers who had saved a payment card: 127,200 people in Texas and 1,328 in Vermont, according to state filings reported by The Record. Revolve has not given a total.[1][2] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- The incident takes place, according to Texas attorney general records cited by Malwarebytes. It is discovered on September 29, per the same records. [2]
- Revolve files a Form 8-K: hackers gained access to multiple company systems and an unauthorized actor took saved payment data "through automated means". It notified federal law enforcement, hired a cybersecurity firm, reports no operational disruption and expects no material financial impact. [1]
- Malwarebytes reports a figure of 1,515,073 people in data returned by the Texas attorney general's portal, alongside 127,200 affected Texans. Revolve has not confirmed the total, and no group has claimed the theft. [2]