Revolve e-commerce breach exposes personal and payment card data of at least 179,259 customers
Online fashion retailer Revolve is notifying at least 180,000 individuals that their personal and payment card data was stolen in a breach of its systems, including its online shopping platform. The intrusion occurred on September 11. Revolve contained and remediated it, notified law enforcement and retained a cybersecurity firm. Notices filed with the Attorney General offices in Iowa, Massachusetts, Texas and Vermont show at least 179,259 people were sent notification letters. Revolve has not disclosed who was behind the attack or how they got in, and it says the incident caused no operational disruption and is not expected to have a material impact on its business.
Detalhes técnicos
- Unauthorized access to certain systems, including the e-commerce platform, on September 11.
- Data that may have been accessed and exfiltrated: names, addresses, payment card numbers and card expiration dates of customers who had saved this data in their accounts.
- The attacker, initial access vector and malware used have not been disclosed.
- Revolve disclosed the incident in a filing with the US SEC.
Remediação
- Revolve is not offering free identity theft or credit monitoring services.
- Affected individuals are advised to review account statements and watch for fraud or identity theft. Reissuing or monitoring exposed payment cards is a reasonable precaution.
Linha do tempo
-
Revolve e-commerce breach exposes personal and payment card data of at least 179,259 customers
ler a análise desta fonte ocultar
Online fashion retailer Revolve is notifying at least 180,000 individuals that their personal and payment card data was stolen in a breach of its systems, including its online shopping platform. The intrusion occurred on September 11. Revolve contained and remediated it, notified law enforcement and retained a cybersecurity firm. Notices filed with the Attorney General offices in Iowa, Massachusetts, Texas and Vermont show at least 179,259 people were sent notification letters. Revolve has not disclosed who was behind the attack or how they got in, and it says the incident caused no operational disruption and is not expected to have a material impact on its business.
Technical Details
- Unauthorized access to certain systems, including the e-commerce platform, on September 11.
- Data that may have been accessed and exfiltrated: names, addresses, payment card numbers and card expiration dates of customers who had saved this data in their accounts.
- The attacker, initial access vector and malware used have not been disclosed.
- Revolve disclosed the incident in a filing with the US SEC.
Remediation
- Revolve is not offering free identity theft or credit monitoring services.
- Affected individuals are advised to review account statements and watch for fraud or identity theft. Reissuing or monitoring exposed payment cards is a reasonable precaution.