# Revolve Breach Exposes Saved Card Numbers for 127,200 Texans

- URL: https://usa-24.com/revolve-data-breach-payment-cards/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-31T10:25:14.114Z
- Updated: 2026-10-31T10:25:14.122Z
- Topics: Data Breach, Payment Card Security, Retail Cybersecurity, SEC Filings, Texas Data Breach

> Hackers took names, contact details, card numbers and expiration dates from saved Revolve accounts, according to an SEC filing. Texas regulators were told 127,200 residents are affected.

## Key takeaways

- Revolve told the SEC in an 8-K filed Thursday, October 29, that hackers stole payment card numbers and card expiration dates from customers who had saved cards to their accounts.
- On Friday, October 30, Revolve told Texas regulators that 127,200 residents had information stolen, and no national total has been published.
- The exposed data also includes customer names and contact details, according to the filing as reported by The Record.
- The attackers used “automated means” to pull the data, and the filing does not say when the intrusion began.
- Shoppers who saved a Revolve card should call their card issuer for a replacement and watch for unfamiliar charges.

Revolve told the Securities and Exchange Commission on Thursday that hackers stole payment card numbers and card expiration dates from shoppers who had saved their cards to their accounts. On Friday, the company told Texas regulators that 127,200 residents had information taken. No national total has been published.

The disclosure came in an 8-K, the current-report form public companies file with the SEC. USA 24 did not have access to the filing itself. The details here come from [The Record’s reporting](https://therecord.media/resolve-fashion-retailer-data-breach-payment-cards), which includes the Texas figure, and from a [breach tracker entry](https://theperimetersite.com/hacked-today) that lists the incident as a SEV 3 data breach dated October 30. Treat the figures as reported until the filing has been checked.

## What the attackers took

According to the filing as The Record describes it, Revolve’s initial investigation found that the attackers used “automated means” to pull data from customers who had saved payment information on the company’s e-commerce platform. The reporting names four data types:

- Names
- Contact details
- Payment card numbers
- Card expiration dates

Card security codes are not on that list. The reporting does not say whether they were accessed, so readers should not assume the exposed set is limited to those four fields until the filing confirms it.

Replacing the card is the most direct way to make a stolen number useless, which is why the call to the issuer is the first step in the checklist below. A card number paired with an expiration date carries more immediate fraud risk than a name and email address alone.

Revolve’s filing also leaves basic questions open. It did not say when the attack happened, and it did not give a total number of affected people. Cybersecurity incidents a company judges to be material fall under Item 1.05 of Form 8-K, a disclosure rule the SEC adopted in 2023. That rule asks companies to describe the material aspects of an incident’s nature, scope and timing, so the missing timing detail is worth watching in any follow-up filing.

## Which Revolve shoppers are affected

Only one figure is confirmed. Revolve told Texas regulators that 127,200 people in that state had information stolen, one day after its SEC filing. The national total is unknown, and the reporting does not give a count for any other state.

Texas is the only state named in the reporting. Shoppers elsewhere should not treat the Texas number as a ceiling, because the filing does not say how many customers live outside the state.

As described, the affected group is customers who saved payment information in their accounts. The reporting does not say whether shoppers who checked out without saving a card were included. Because names and contact details are also on the exposed list, anyone who has used a Revolve account should watch for targeted phishing.

## Where Revolve fits in a difficult October

The Record places the incident within a wider run of breaches that [Just Security](https://justsecurity.org/162627/early-edition-october-30-2026) calls “Black October.” Fashion retail has been a repeat target. The Record notes that ASOS, Levi Strauss, Mango and North Face all faced attacks over the past two years.

ASOS’s own October incident is the closest recent comparison. The company [linked its breach](https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/) to a social-engineering attack that stole an employee’s login credentials, and it said payment card data and passwords were not accessed. Revolve’s filing describes a different outcome, since card numbers and expiration dates were taken. Revolve has not said how its attackers got in, so readers should not assume the ASOS attack path applies.

Compared with earlier retail breaches, the most important detail is the data type rather than the headline count. Full card numbers with expiration dates demand faster action from shoppers than most contact-data leaks do, which is why card-data disclosures usually produce more urgent advice.

Dollar figures elsewhere this month are far larger. USA 24 has covered the [Binance hack](https://usa-24.com/binance-hack-6-3-billion-update/), which is measured in billions. The Revolve case is smaller in dollars, but it lands on ordinary shoppers and their everyday cards.

Who bears the cost is fairly clear. Shoppers with stored cards carry the hassle of replacing them and checking statements. Revolve faces disclosure obligations, customer notices and questions about its security. Most US card networks limit a cardholder’s liability for unauthorized charges, but that protection generally depends on reporting fraud promptly.

Other recent cases point the same way. USA 24 has reported on a [Quest Diagnostics breach](https://usa-24.com/quest-diagnostics-data-breach-quanum-2/) that exposed patient records through the Quanum platform, and on a [Chainalysis breach](https://usa-24.com/chainalysis-breach-customer-data-exposed/) in which hackers accessed customer data. The common thread is personal data held by a company that attackers can reach.

## What Revolve shoppers should do now

The steps below are general guidance, not instructions from Revolve or the filing. If you receive a notice letter from the company, follow its instructions first.

1. Check recent card statements for charges you do not recognize, including small test charges.
2. If you saved a Revolve card, call your card issuer and ask for a replacement card number.
3. Turn on transaction alerts in your bank or card app so you see purchases as they post.
4. Remove saved cards from your Revolve account and use another payment method until you have a new card.
5. Treat messages about “your Revolve order” as possible phishing. Go directly to the official site or app instead of clicking links.
6. Report unfamiliar charges to your card issuer quickly, since prompt reporting is what protects you under most card liability rules.

## What to watch next

Three questions will shape how large this gets. First, the full 8-K text should confirm when the intrusion began and when Revolve found it. Second, notices filed in other states should show whether the Texas figure is a small part of a larger total. Third, Revolve needs to explain how the attackers got in, which tells other retailers whether their own checkout systems face the same risk.

A separate problem is also unresolved. A cyber incident at BAE Systems has disrupted bankruptcy notices from US courts since October 9, and the reporting does not give a restoration date, according to [SecurityWeek](https://www.securityweek.com/bae-systems-security-incident-stalls-notices-from-us-bankruptcy-courts/) and [eSecurityPlanet](https://www.esecurityplanet.com/cybersecurity/news-bae-systems-cyber-incident-us-bankruptcy-court-notices/). It is unrelated to Revolve, but it is another reminder that a single breach can slow notices people depend on.

The next signal will come from the notice letters Revolve sends and any revised count it files. Those documents will show whether the Texas number is the first piece of a larger picture, and they will tell shoppers whether a saved card needs replacing now or can wait.

## Frequently asked questions

### Did Revolve get hacked?

Yes, according to Revolve’s SEC 8-K filing as reported by The Record. Hackers gained access to multiple company systems and took names, contact details, payment card numbers and card expiration dates from customers who had saved payment information. The filing did not say when the attack happened.

### How many people were affected by the Revolve data breach?

Revolve told Texas regulators on Friday, October 30, that 127,200 Texas residents had information stolen. The company has not published a national total, so the number of affected shoppers across the country is unknown. Only the Texas count is confirmed in the reporting.

### Was my card number stolen in the Revolve breach?

The filing as described points to customers who saved payment cards to their Revolve accounts. If you saved a card, check your statements for unfamiliar charges and call your issuer for a replacement. If you never saved a card, the reporting does not place you in the affected group, but stay alert for phishing.

### What should Revolve shoppers do right now?

Check recent card statements, turn on transaction alerts, and ask your card issuer to replace any card saved to Revolve. Treat unexpected messages about a Revolve order as possible phishing and go directly to the official site or app. Follow any instructions in a notice letter if you receive one.

## Sources

1. [Fashion retailer Resolve says hackers stole payment card information](https://therecord.media/resolve-fashion-retailer-data-breach-payment-cards)
2. [What Got Hacked Today? Latest Cyber Attacks & Breaches](https://theperimetersite.com/hacked-today)
3. [Early Edition: October 30, 2026 (Just Security)](https://justsecurity.org/162627/early-edition-october-30-2026)
4. [ASOS links data breach to social engineering attack, credential theft](https://www.bleepingcomputer.com/news/security/asos-links-data-breach-to-social-engineering-attack-credential-theft/)
5. [BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts](https://www.securityweek.com/bae-systems-security-incident-stalls-notices-from-us-bankruptcy-courts/)
6. [US Bankruptcy Court Notices Disrupted by BAE Systems Cyber Incident](https://www.esecurityplanet.com/cybersecurity/news-bae-systems-cyber-incident-us-bankruptcy-court-notices/)