Revolve Data Breach Exposes Payment Card Details of Up to 1.5 Million Customers
Online fashion retailer Revolve Group disclosed that an unauthorized actor accessed customers' saved payment data through automated means, stealing card numbers, expiration dates, names, and addresses. Only customers who had saved a payment card as a method in their Revolve account were affected. According to a filing with the Texas Attorney General, the incident occurred on September 11, 2026 and was discovered on September 29, 2026; the Texas site lists 127,200 affected Texans, while a non-public figure of 1,515,073 appears in the site's underlying data as the total affected nationwide, though Revolve has not confirmed this number. Revolve's SEC filing does not mention whether CVV codes were exposed, and it remains unclear whether card numbers were fully visible or masked. No threat actor or group has publicly claimed responsibility.
Detalhes técnicos
The attacker is believed to have obtained the saved payment data through automated means, per Revolve's SEC filing, though the specific technique (e.g., credential stuffing, API abuse) was not disclosed. CVV codes were not mentioned as compromised, which may limit immediate card-not-present fraud risk, though exposed card numbers, expiration dates, and contact details could still enable fraud or more convincing phishing.
Remediação
Affected customers are advised to review card statements for small unauthorized test charges, watch for unfamiliar merchant names, report fraud immediately to their card issuer, remove saved payment cards from online accounts, and request card reissuance with a new number. Users should also be cautious of unsolicited calls, texts, or emails referencing the breach, as scammers may use stolen details to appear legitimate.
Linha do tempo
-
Revolve Data Breach Exposes Payment Card Details of Up to 1.5 Million Customers
ler a análise desta fonte ocultar
Online fashion retailer Revolve Group disclosed that an unauthorized actor accessed customers' saved payment data through automated means, stealing card numbers, expiration dates, names, and addresses. Only customers who had saved a payment card as a method in their Revolve account were affected. According to a filing with the Texas Attorney General, the incident occurred on September 11, 2026 and was discovered on September 29, 2026; the Texas site lists 127,200 affected Texans, while a non-public figure of 1,515,073 appears in the site's underlying data as the total affected nationwide, though Revolve has not confirmed this number. Revolve's SEC filing does not mention whether CVV codes were exposed, and it remains unclear whether card numbers were fully visible or masked. No threat actor or group has publicly claimed responsibility.
Technical Details
The attacker is believed to have obtained the saved payment data through automated means, per Revolve's SEC filing, though the specific technique (e.g., credential stuffing, API abuse) was not disclosed. CVV codes were not mentioned as compromised, which may limit immediate card-not-present fraud risk, though exposed card numbers, expiration dates, and contact details could still enable fraud or more convincing phishing.
Remediation
Affected customers are advised to review card statements for small unauthorized test charges, watch for unfamiliar merchant names, report fraud immediately to their card issuer, remove saved payment cards from online accounts, and request card reissuance with a new number. Users should also be cautious of unsolicited calls, texts, or emails referencing the breach, as scammers may use stolen details to appear legitimate.