Revolve Breach Exposed Saved Payment Cards Taken 'Through Automated Means' — At Least 197,000 Notified as State Data Hints at 1.5 Million
Fashion retailer Revolve says names, contact details, card numbers and expiry dates saved in customer accounts were taken in a September 2026 incident, and affected customers should ask their bank for a replacement card.
What Happened
Online fashion retailer Revolve is notifying customers that attackers obtained payment card details saved in their Revolve accounts. The company disclosed the incident in a filing with the US Securities and Exchange Commission and in breach notices filed with state attorneys general.
According to the listing on the Texas attorney general's breach portal, the incident took place on 11 September 2026 and was discovered on 29 September. Revolve has not said how the attackers got in. Its SEC filing says only that it believes an unauthorised actor may have obtained the data "through automated means". No group has claimed responsibility.
What Data Was Exposed
According to the regulatory filings, the exposed data includes:
- Customer names and contact information, including addresses
- Payment card numbers
- Card expiration dates
Only customers who saved a payment card as a payment method in their Revolve account are affected. The SEC filing does not mention card verification codes (CVV/CVC). It is unclear whether the card numbers were stored in full or masked, and whether Revolve or a third-party payment processor held them.
How Many People Are Affected
The total is not yet clear, and the numbers in circulation vary widely:
- The Texas filing lists 127,200 affected Texans.
- Filings across several states account for at least about 197,000 notified people so far.
- A figure of 1,515,073 appears as a total in data returned by the Texas breach portal but is not shown publicly. Revolve has not confirmed it, and several sites repeating it appear to rely on that single record.
Revolve's SEC filing gave no number. Until the company publishes one, treat the 1.5 million figure as unconfirmed but plausible.
What "Automated Means" Could Mean
Revolve has given no technical detail. The wording is consistent with several common attack patterns against retailers:
- Credential stuffing: bots trying usernames and passwords leaked from other breaches until they find accounts that reuse them. Saved cards are then visible or usable inside each account.
- API abuse: automated requests against account or checkout endpoints that return more payment detail than they should.
- Scraping after a single foothold: scripts that harvest data in bulk once an attacker has some access.
These are possibilities, not findings. The difference matters for customers: if accounts were taken over through reused passwords, those passwords are compromised elsewhere too.
Who Is Affected
Revolve customers in the United States, and potentially elsewhere, who had a card saved to their account around September 2026. Customers who checked out without saving a card, or paid through a third-party wallet, should be outside the scope described in the filings. Anyone who receives a letter should assume their card number and expiry date are in criminal hands.
What To Do Now
If you are a Revolve customer:
- Ask your card issuer to cancel and reissue the card you saved at Revolve, even if you have seen no fraud. A new number makes the stolen data worthless.
- Review statements going back to September for small or unfamiliar charges. Fraudsters often test stolen cards with tiny transactions first.
- Change your Revolve password, and change it anywhere else you reused it. Use a password manager and unique passwords.
- Remove saved cards from shopping accounts you rarely use. This does not undo the exposure, but it shrinks future ones.
- Expect phishing. Breach notices are a favourite lure. Don't call numbers or click links in unexpected emails or texts about the breach. Verify through the number on the back of your card or the retailer's official website.
If you run an e-commerce platform:
- Store cards only as processor tokens, never as full card numbers, and never show more than the last four digits in the account interface.
- Put bot management and rate limiting on login, account and checkout APIs, and alert on large numbers of failed logins or bulk account access.
- Offer and encourage multi-factor authentication and passkeys for customer accounts.
- Require step-up authentication before a saved card can be used or viewed after a login from a new device.
Why It Matters
Saved cards are a convenience customers expect, and they turn every customer account into a target. Retail breaches no longer need a malicious checkout skimmer. Automated abuse of ordinary account features can reach the same data.
The gap between the attack (11 September), the discovery (29 September) and the customer letters in November also leaves a long period in which stolen cards could be used before victims knew to cancel them. The confusion over whether about 200,000 or 1.5 million people are affected shows how much depends on companies being clear about scope.
