Revolve discloses payment-card breach in SEC 8-K filing
Fashion retailer Revolve told the SEC that attackers used automated means to steal customer names, contact details, and saved payment card numbers with expiration dates.
Online fashion retailer Revolve Group disclosed a data breach in an 8-K filing with the SEC dated October 29, 2026, saying an unauthorized party used "automated means" to access customer records that include payment card numbers and expiration dates. The breach was first reported by Recorded Future News, which also surfaced the state regulator filings below.
What was taken
Per Revolve's 8-K, the exposed data for affected customers includes:
- Name and contact information
- Payment card number and card expiration date
Only customers who saved their payment details in their online Revolve account appear to be affected. The company says an unauthorized actor "may have obtained, through automated means," that information after gaining access to multiple company systems.
How many
Revolve has not published a total. The scope so far comes from state breach notifications:
- Texas — 127,200 residents affected
- Vermont — 1,328 residents
- Massachusetts — notification filed, no figure disclosed
Those are per-state counts reported via regulators, not a nationwide total, so the real figure is higher.
How it happened
Revolve did not describe the entry point or the attack technique beyond "automated means" across "multiple company systems." Notably, the filing does not mention a Magecart-style web skimmer or client-side card-stealing script — the usual way card data leaks from an e-commerce checkout. That the exposed cards were ones customers had stored in their accounts points toward access to back-end systems or a stored-data repository rather than live checkout interception, but Revolve has not confirmed a mechanism. Treat the vector as unconfirmed.
Attribution and timeline
No threat actor has been named or has claimed the breach. Revolve says it notified federal law enforcement and engaged an outside cybersecurity firm. The company has not disclosed when the intrusion occurred or how long attackers had access.
What to do today
If you have a Revolve account with a card on file:
- Assume the stored card is compromised. The number and expiration date are enough for card-not-present fraud. Request a replacement card from your issuer.
- Turn on transaction alerts and review statements for small "tester" charges, which fraudsters use before larger ones.
- Delete saved cards from merchant accounts you don't actively use. This breach only touched customers who stored payment details — a reminder that a saved card is standing risk.
- Ignore "Revolve breach" emails asking you to verify a card. Expect phishing to follow the headlines; go to the retailer or your bank directly.
Context
Retail card breaches disclosed through SEC 8-Ks have become routine since the 2023 reporting rules took effect — the filing is now often the first public signal, ahead of any customer letter or state notice. The pattern to watch here is the data set: stolen stored cards, not intercepted checkout traffic. If Revolve confirms back-end access, it belongs with the credential-and-systems intrusions rather than the client-side skimmer wave that has dominated e-commerce card theft. For now, the company has said neither.