Revolve breach: saved payment card data stolen via automated means on Sept 11; Indiana AG filing shows 1,515,073 affected
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 10/11/2026 00:05; os links antigos trazem para cá.
Online fashion retailer Revolve (Revolve Group) disclosed in an SEC filing on October 29 that an unauthorized actor accessed certain systems, including its e-commerce platform, on September 11, 2026. Stolen data includes names, addresses, payment card numbers and expiration dates of customers who had saved a card in their accounts. A later report says Revolve told the Indiana Attorney General's Office that 1,515,073 individuals were impacted (securityweek.com, Nov 9). This matches the total that Malwarebytes had earlier drawn from the Texas filing's data, when Revolve had not confirmed it (malwarebytes.com). Notices to regulators in Iowa, Massachusetts, South Carolina, Texas and Vermont cover only about 197,000 people combined, so the state filings alone do not reflect the full count (securityweek.com). Revolve says it contained and remediated the incident, notified law enforcement and retained a cybersecurity firm. It reports no operational disruption and no expected material business impact (securityweek.com). No threat actor has publicly claimed responsibility.
Detalhes técnicos
- The intrusion occurred on September 11, 2026 and was discovered on September 29, 2026 (malwarebytes.com, citing the Texas Attorney General filing; securityweek.com gives the same dates).
- According to the SEC filing, the attacker is believed to have obtained saved payment data through automated means; the specific technique (e.g., credential stuffing or API abuse) was not disclosed (malwarebytes.com, securityweek.com).
- Data exposed: names, contact details, mailing addresses, payment card numbers and card expiration dates, only for customers who chose to save a card in their account (securityweek.com).
- The SEC filing does not mention whether CVV codes were exposed, and it is unclear whether card numbers were fully visible or masked (malwarebytes.com). The absence of CVV may limit immediate card-not-present fraud, but the data could still enable fraud or convincing phishing.
- The initial access vector, malware used and the attacker remain undisclosed (securityweek.com). No CVE, vulnerability or IOCs have been published.
Remediação
- Review card statements for small unauthorized test charges and unfamiliar merchant names; report fraud immediately to the card issuer.
- Remove saved payment cards from online accounts and request card reissuance with a new number (malwarebytes.com).
- Be cautious of unsolicited calls, texts or emails referencing the breach, as scammers may use the stolen details to appear legitimate (malwarebytes.com).
- Revolve is not offering free identity theft or credit monitoring services (securityweek.com).
Relatos divergentes
- Number of victims: securityweek.com (Nov 2) reported at least 179,259 notified individuals across four states (Iowa, Massachusetts, Texas, Vermont), while malwarebytes.com (Nov 3) cited a non-public figure of 1,515,073 nationwide in the Texas site's data and 127,200 affected Texans, which Revolve had not confirmed at that time. The most recent source, securityweek.com (Nov 9), reports that Revolve told the Indiana Attorney General's Office that 1,515,073 people were impacted, and that filings in five states (adding South Carolina) cover only about 197,000 people. The 1,515,073 figure is therefore now the best-supported total, and the earlier 179,259 count reflects only the partial state-level notifications.
Linha do tempo
-
Revolve data breach affects 1,515,073 people, exposing names, addresses and stored payment card data
ler a análise desta fonte ocultar
Revolve, an online fashion retailer, told the Indiana Attorney General's Office that 1,515,073 individuals were impacted by the intrusion it disclosed in an SEC filing on October 29. The unauthorized party broke into some of Revolve's systems, including its e-commerce platform, on September 11, and the company became aware of it on September 29. The intruder may have used "automated means" to collect customer names, contact details, mailing addresses, card numbers and expiration dates, and the exposure is limited to shoppers who had chosen to store a payment method in their accounts. Notices sent to regulators in Iowa, Massachusetts, South Carolina, Texas and Vermont covered roughly 197,000 people combined, so the state filings alone do not reflect the full count. Revolve has reported the attack to federal law enforcement, has brought in external cybersecurity experts, and has not yet explained how the intruders got in; no hacker group has claimed the attack. The article does not name a CVE, a vulnerability or any IOCs, so the entry carries no technical indicators.
-
Revolve Data Breach Exposes Payment Card Details of Up to 1.5 Million Customers
ler a análise desta fonte ocultar
Online fashion retailer Revolve Group disclosed that an unauthorized actor accessed customers' saved payment data through automated means, stealing card numbers, expiration dates, names, and addresses. Only customers who had saved a payment card as a method in their Revolve account were affected. According to a filing with the Texas Attorney General, the incident occurred on September 11, 2026 and was discovered on September 29, 2026; the Texas site lists 127,200 affected Texans, while a non-public figure of 1,515,073 appears in the site's underlying data as the total affected nationwide, though Revolve has not confirmed this number. Revolve's SEC filing does not mention whether CVV codes were exposed, and it remains unclear whether card numbers were fully visible or masked. No threat actor or group has publicly claimed responsibility.
Technical Details
The attacker is believed to have obtained the saved payment data through automated means, per Revolve's SEC filing, though the specific technique (e.g., credential stuffing, API abuse) was not disclosed. CVV codes were not mentioned as compromised, which may limit immediate card-not-present fraud risk, though exposed card numbers, expiration dates, and contact details could still enable fraud or more convincing phishing.
Remediation
Affected customers are advised to review card statements for small unauthorized test charges, watch for unfamiliar merchant names, report fraud immediately to their card issuer, remove saved payment cards from online accounts, and request card reissuance with a new number. Users should also be cautious of unsolicited calls, texts, or emails referencing the breach, as scammers may use stolen details to appear legitimate.
-
Revolve e-commerce breach exposes personal and payment card data of at least 179,259 customers
ler a análise desta fonte ocultar
Online fashion retailer Revolve is notifying at least 180,000 individuals that their personal and payment card data was stolen in a breach of its systems, including its online shopping platform. The intrusion occurred on September 11. Revolve contained and remediated it, notified law enforcement and retained a cybersecurity firm. Notices filed with the Attorney General offices in Iowa, Massachusetts, Texas and Vermont show at least 179,259 people were sent notification letters. Revolve has not disclosed who was behind the attack or how they got in, and it says the incident caused no operational disruption and is not expected to have a material impact on its business.
Technical Details
- Unauthorized access to certain systems, including the e-commerce platform, on September 11.
- Data that may have been accessed and exfiltrated: names, addresses, payment card numbers and card expiration dates of customers who had saved this data in their accounts.
- The attacker, initial access vector and malware used have not been disclosed.
- Revolve disclosed the incident in a filing with the US SEC.
Remediation
- Revolve is not offering free identity theft or credit monitoring services.
- Affected individuals are advised to review account statements and watch for fraud or identity theft. Reissuing or monitoring exposed payment cards is a reasonable precaution.