Quick Answer
Revolve says an unauthorized actor may have obtained saved payment-card details from its online shopping platform. The company says the affected data may include names, addresses, card numbers, and expiration dates. Customers who saved a card should review statements now, contact their card issuer about unfamiliar charges, and consider a fraud alert or credit freeze to limit further misuse.
Key Takeaways
- Revolve disclosed unauthorized access to certain systems on October 29, 2026.
- The company says unauthorized access to its shopping platform occurred on September 11, 2026.
- Potentially affected data includes names, addresses, payment-card numbers, and expiration dates.
- Revolve says the data may have been obtained through automated means from accounts with saved payment information.
- State notices accounted for at least 197,072 notified people as of November 3, 2026.
What happened in the Revolve data breach?
The Revolve data breach involved unauthorized access to certain company systems and Revolve’s online shopping platform. Revolve disclosed the incident in an October 29, 2026, filing with the U.S. Securities and Exchange Commission, stating that the activity had been remediated and that an unauthorized actor may have obtained customer information through automated means. Revolve’s SEC filing also says the company notified federal law enforcement and hired external cybersecurity experts to investigate and respond.
Revolve’s customer notification letter identifies September 11, 2026, as the date an unauthorized actor accessed the online shopping platform. The company says it determined on September 29, 2026, that the affected information included payment-card data. Those dates matter because customers who used a saved card around that period have a clear reason to inspect their accounts, even if they have not received a suspicious-charge alert.
Revolve says customer service and operations were not interrupted, and the company does not believe the incident will materially affect its business. That operational assessment does not reduce the personal financial risk for an individual whose payment information was involved. The practical response is to treat unfamiliar activity on a card statement as urgent and report it promptly through the card issuer’s established support channel.
What customer data may have been exposed?
The Revolve data breach may have exposed customers’ names, addresses, payment-card numbers, and payment-card expiration dates. Revolve listed those data categories in its consumer notification letter filed with the California Department of Justice. Revolve’s California notification letter is the company’s most detailed public explanation of the potentially affected customer information.
Payment-card numbers and expiration dates are more sensitive than ordinary contact details because they can be used in attempted unauthorized transactions. Names and addresses can also make phishing messages appear more credible when criminals already know that a person has shopped with a specific retailer. Customers should therefore be cautious about unsolicited messages that claim to offer breach compensation, a refund, or a required account verification step.
The available public notices do not establish that every Revolve customer had the same data exposed. Revolve says the information may have been obtained from customers who saved payment information in their e-commerce accounts. Customers who did not save a payment method should not assume they were unaffected, but customers with a saved card have the most direct reason to monitor payment activity and review any notice they receive from Revolve.
How many people have been notified about the Revolve breach?
The Revolve data breach has affected at least 197,072 notified people based on state breach notices reviewed through November 3, 2026. The total reflects notices filed in Iowa, Massachusetts, South Carolina, Texas, and Vermont, including 17,813 South Carolina residents added in an update. SecurityWeek’s review of state notices provides the reported state-by-state count.
The reported figure is a notification count, not a final statement that every person’s card was used fraudulently. Breach totals can also change as companies complete investigations, identify additional affected residents, or file notices in more states. For most shoppers, the more useful question is whether their own payment card was stored in a Revolve account and whether any unfamiliar transactions have appeared since the platform access occurred.
| Date | Revolve breach event | Why the date matters |
|---|---|---|
| September 11, 2026 | Unauthorized actor accessed Revolve’s online shopping platform. | Customers can use this date as a reference point when reviewing card activity. |
| September 29, 2026 | Revolve determined that certain customer data included payment-card information. | The company identified the data categories that may have been involved. |
| October 29, 2026 | Revolve disclosed the incident in an SEC Form 8-K. | The filing says the activity had been remediated and law enforcement was notified. |
| November 3, 2026 | State notices accounted for at least 197,072 notified people. | The known notification total may change as more notices are filed. |
Why are saved payment cards a higher concern?
Saved payment cards are the central concern in the Revolve data breach because Revolve says the information may have been obtained through automated means from customers who stored payment information in e-commerce accounts. Automated collection can allow an intruder to gather stored account data at scale rather than relying on a single fraudulent purchase or a one-time interaction with an individual shopper.
Customers should not enter card details or account credentials into a link sent by email or text simply because the message mentions Revolve. A breach can create an opening for impersonation attempts, particularly when a sender uses a customer’s name, address, or recent shopping relationship to make a message seem legitimate. The safer approach is to open the card issuer’s official app or website directly and use contact information printed on the physical card.
Retail account security also matters after a payment-card incident because account access can contain saved addresses and payment preferences. Shoppers who want a broader review of similar security problems can examine how compromised browser extensions can affect online activity. The immediate priority remains financial monitoring, because Revolve’s notice specifically identifies card numbers and expiration dates among the potentially affected data.
What should affected Revolve customers do now?
Affected Revolve customers should review payment-card statements and report unauthorized charges promptly. Revolve’s customer notice specifically advises affected people to monitor card activity and consider a fraud alert or credit freeze. Customers should document the transaction date, merchant name, and amount before contacting the card issuer, because those details can help the issuer investigate the charge.
- Review recent payment-card statements for purchases you do not recognize.
- Contact the card issuer promptly about any unfamiliar charge.
- Consider a fraud alert or credit freeze if the Revolve notice applies to you.
- Use Revolve’s dedicated information line at 888-517-6458 if you need information about the notice.
- Keep records of notifications, issuer communications, and disputed transactions.
Customers should use the card issuer’s official phone number or app when reporting a transaction, rather than relying on a phone number supplied in an unexpected email or text. The same caution applies to account alerts from other services. A recent customer account breach illustrates why consumers should distinguish a verified company notice from messages that only claim to come from a company.
Stop and contact your card issuer immediately if you see an unauthorized transaction. Revolve can provide incident information, but a card issuer is the appropriate organization to address a disputed card charge and discuss the available protections for that account.
Has Revolve said the breach has been contained?
Revolve says the unauthorized activity had been remediated by the time of its October 29, 2026, SEC filing. The company also says it retained external cybersecurity experts and notified federal law enforcement, which indicates that the response included both technical investigation and notification to relevant authorities.
Containment means Revolve says it addressed the identified unauthorized activity. Containment does not establish that previously obtained customer data can no longer be misused, because data copied during an incident can remain available to the unauthorized party after access to the original system ends. That distinction is why statement monitoring remains necessary even after a company reports that a breach was remediated.
Revolve says the incident did not interrupt customer service or operations and that it does not expect a material effect on its business. Customers should view that statement as an assessment of Revolve’s operations, not as a guarantee about individual payment-card risk. The sensible next step is to follow the company’s stated monitoring guidance and address unusual charges through the card issuer.
How can shoppers protect online retail accounts after this breach?
Online shoppers can reduce future exposure by reviewing where payment information is stored and by limiting saved cards to accounts they actively use. Revolve’s disclosure specifically concerns payment information saved in e-commerce accounts, so shoppers may want to check saved payment methods across retail accounts and remove details they no longer need.
Online retail accounts also deserve careful attention because account access can reveal order history, addresses, and saved payment preferences. Customers should independently navigate to the retailer’s website or app before changing account details, especially after receiving an unexpected security message. A separate prompt data exposure incident also shows why the scope of exposed information matters when deciding which accounts and records need review.
Customers should focus first on the accounts and cards directly connected to Revolve. The public information does not establish that unrelated accounts were accessed, so there is no reason to make unsupported assumptions about other services. Monitoring the relevant card, retaining notices, and reporting suspicious activity promptly are proportionate steps based on the information Revolve has disclosed.
FAQ
What information was exposed in the Revolve data breach?
Revolve says the potentially affected information included names, addresses, payment-card numbers, and card expiration dates. The company says the data may have come from customers who saved payment information in their e-commerce accounts.
Did the Revolve breach affect every customer?
No, Revolve’s public notices do not state that every customer was affected. Revolve says the potentially obtained information involved customers who had saved payment information, but affected people should review any direct notice from the company.
How many people were affected by the Revolve data breach?
At least 197,072 people were included in state breach notices reviewed through November 3, 2026. That count may change as additional state notices are filed or updated.
Should Revolve customers freeze their credit?
Revolve advises affected people to consider a fraud alert or credit freeze. Customers should consider that option based on their personal circumstances and should promptly report any unauthorized payment-card charge to the card issuer.
Who should Revolve customers call about the breach?
Revolve lists a dedicated information line at 888-517-6458 in its consumer notice. Customers who find an unfamiliar card charge should also contact the card issuer directly using the official number on the card or in the issuer’s app.