Excerpt from SecurityWeek, Published on November 2, 2026
The Revolve data breach has raised cybersecurity concerns after the online fashion retailer disclosed unauthorised access to its systems, potentially exposing personal and payment information belonging to customers. The incident involved the company’s e-commerce platform and affected customers who had saved payment details in their online shopping accounts.
The Revolve data breach occurred on September 11, 2026, when an unauthorised actor gained access to certain company systems, including its online shopping platform.In a regulatory filing with the US Securities and Exchange Commission (SEC) on October 29, Revolve Group disclosed that an unauthorised actor may have obtained customer names, contact information, payment card numbers, and card expiration dates through automated means. The information involved customers who had saved payment details in their Revolve accounts.
Following the discovery, the company initiated its cybersecurity incident response procedures, contained the unauthorised activity, and engaged external cybersecurity specialists to investigate the incident. Revolve also notified federal law enforcement authorities and implemented additional security measures. Breach notifications filed with authorities in five US states identified a combined total of 197,072 potentially affected individuals. The breakdown includes 127,200 residents in Texas, 46,813 in Massachusetts, 17,813 in South Carolina, 3,918 in Iowa, and 1,328 in Vermont.
However, Revolve has not publicly disclosed an official nationwide figure for affected customers. The reported total represents the combined count from the available state notifications.The company stated that the incident did not disrupt its business operations or interrupt customer services. It also indicated that the breach was not expected to have a material impact on its business.
The investigation highlights the extent of customer information potentially exposed through the incident, although the full scope of the breach remains undisclosed.
For additional information, read the full report from SecurityWeek.
