Revolve Group, Inc., the online fashion retailer, has disclosed unauthorized access to certain company systems that may have exposed saved customer payment card information. This page summarizes what the company and regulators have made public so far.
Revolve Group’s Data Breach Investigation
On October 29, 2026, a data security incident reported by Revolve Group, Inc. appeared on the Vermont Attorney General’s list of security breach notices. The listing classifies the organization as an other commercial entity and shows that 1,328 Vermont residents were affected. The categories of information it names are financial account codes and credit and debit account information.
The company has also described the incident in a Form 8-K filed with the Securities and Exchange Commission, which news outlets summarized. Revolve says it recently identified unauthorized access to certain of its systems and promptly started its cyber incident response protocols. Based on its investigation, the company believes an unauthorized actor may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date of certain customers. The affected customers are those who had saved payment information in online shopping accounts on the company’s e-commerce platform.
The company says it remediated the unauthorized activity, investigated the incident with the help of external cybersecurity experts, put enhanced security measures in place intended to prevent a similar event, and notified federal law enforcement authorities. It also says the incident did not disrupt operations or interrupt service to customers, and that it does not currently believe the event will have a material impact on its business. That statement is about the company’s finances and operations. It does not speak to the risk faced by individual customers whose card details may have been taken.
The figure of 1,328 covers only Vermont residents. Companies that notify people in more than one state often file with several states, each with its own count, so the Vermont number should not be read as the total number of people affected. The company has not published a total in the sources found so far, and the Vermont listing does not say how many customers nationwide had saved payment information.
The public statements say the data was obtained through automated means, but they do not explain what that means in practice, how long the unauthorized access lasted, or when it began. The date of discovery has not been stated. The statements also do not say whether the company will offer credit monitoring or identity protection, whether the stolen card numbers have been used, or who was behind the activity, so those points should be treated as unknown for now.
Online retailers are frequent targets because their customer accounts can hold stored payment details, addresses, phone numbers and purchase histories in one place. Attackers who use automated tools can test large numbers of credentials or probe a site’s systems quickly, which is one reason incidents of this kind can reach many accounts before they are noticed. Saved card numbers with expiration dates are valuable to criminals because they can be used for fraudulent online purchases or sold to others.
A card number and expiration date alone are not always enough to complete every transaction, since many merchants also ask for a security code. Even so, the combination of a name, contact details and card information gives criminals material for phishing messages that appear to come from a retailer or a bank, and for attempts to reach the cardholder by phone or text. Customers who saved a card with the company should treat unexpected messages about their account or card with caution.
Because the public record is limited, the most reliable source of detail right now is any notice you receive from the company or your card issuer. If you have a Revolve account with a saved card, consider checking your statements and asking your card issuer whether replacing the card makes sense. Details about the incident may emerge as more information is made public, and this page reflects only what the Vermont listing and the company’s own statements confirm.
When Did This Breach Occur?
The Vermont listing shows the incident was reported on October 29, 2026. The company’s public statements describe the unauthorized access as recent but do not give the date it began, the date it was discovered or the date it was stopped, so the timing of the underlying event should be treated as not publicly stated.
What Information Was Breached?
The company says an unauthorized actor may have obtained the name, contact information, payment card number and payment card expiration date of certain customers who saved payment information in an online shopping account. The Vermont listing describes the categories as financial account codes and credit and debit account information. No other data types are listed. Your notice or card issuer is the best guide to what applies in your case.
What You Can Do
If you have an account with Revolve Group or believe your card details may be affected, consider these steps:
- Review recent card statements and online banking activity for charges you do not recognize, and report them to your card issuer right away.
- Ask your card issuer about replacing a card you saved with the retailer, and remove saved payment details from online accounts you no longer use.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Be skeptical of unexpected calls, texts or emails that mention the incident or your account, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Revolve Group
If you received a notice about this incident, or you believe your payment card information was exposed, you may have legal options for holding the responsible parties accountable for how they protected your sensitive information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
