# Revolve Data Breach Exposes Saved Cards, Up to 1.5 Million Affected

- URL: https://usa-24.com/revolve-data-breach-saved-cards/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-07T05:02:34.726Z
- Updated: 2026-11-07T05:02:34.730Z
- Topics: Data Breach, Payment Card Fraud, Retail Security, Consumer Privacy, Revolve

> Revolve has not confirmed a national total, but estimates of the saved-card breach range from 197,072 to 1.5 million people. Here is what the company disclosed and what to do now.

## Key takeaways

- Revolve disclosed in an SEC filing dated Oct. 29, 2026, that unauthorized parties accessed some systems, including its online shopping platform.
- Only customers who saved payment cards to their accounts appear affected, with names, addresses, card numbers and expiration dates possibly taken.
- Estimates range from at least 197,072 people in state notices to as many as 1,515,073 in Malwarebytes' analysis of Texas portal data, and Revolve has not confirmed a total.
- Revolve is not offering free identity theft or credit monitoring, so affected shoppers should ask their card issuer to cancel and replace compromised cards.
- The breach date is Sept. 11, 2026 and the discovery date is Sept. 29, according to Texas filing records.

Saved payment cards at Revolve may have been exposed in an attack that began in September, and the company has not published a national count of affected customers. Public estimates now run from at least 197,072 people to as many as 1,515,073, and the figures come from different kinds of records.

The breach surfaced in a Securities and Exchange Commission filing dated Oct. 29, 2026. In it, Revolve said some of its systems, including its online shopping platform, were accessed without authorization, according to [All About Cookies](https://allaboutcookies.org/revolve-data-breach). The company said it stopped the activity, strengthened security, notified federal law enforcement and hired outside cybersecurity experts, and that operations were not disrupted.

The story reached a wider audience in early November. [PYMNTS](https://www.pymnts.com/cybersecurity/2026/revolve-reports-breach-fashion-retail-platform/) and SecurityWeek reported the notifications, and on Nov. 3 [Malwarebytes](https://www.malwarebytes.com/blog/data-breaches/2026/11/revolve-card-breach-1-5-million-people-may-be-affected) published its 1.5 million estimate. The attack itself is older. Texas filing records list the breach date as Sept. 11, 2026 and the discovery date as Sept. 29, 2026, according to [Malwarebytes](https://www.malwarebytes.com/blog/data-breaches/2026/11/revolve-card-breach-1-5-million-people-may-be-affected) and [McAfee](https://www.mcafee.com/blogs/security-news/revolve-data-breach/).

## Revolve data breach: what data may have been taken

The exposure is narrower than a full customer database. According to SecurityWeek's reporting, as relayed by PYMNTS, attackers may have taken names, addresses, payment card numbers and expiration dates, but only for customers who saved payment cards to their accounts.

Malwarebytes noted that the SEC filing does not mention card verification value (CVV) numbers. Many online merchants ask for that code in addition to the card number, so its absence narrows the risk. Card numbers, expiration dates and names still give criminals material for phishing and small test charges, which is why the cards themselves need attention.

Revolve says it does not know how attackers obtained the saved payment data. The filing, as quoted by Malwarebytes, says an unauthorized actor may have obtained the data "through automated means." That phrase could point to scripted access rather than a single targeted intrusion, but the company has not described the method or the extra safeguards it added.

## How many people the Revolve breach affected

Three figures are in circulation, and they do not measure the same thing. The table below lists each one and what it is based on.

| Source | Figure | What it measures |
|---|---|---|
| SecurityWeek, as reported by PYMNTS | At least 200,000 | People Revolve notified |
| Strobes roundup of state notices | At least 197,072 | People across state breach notices, including 127,200 in Texas |
| Malwarebytes, from Texas portal data | Up to 1,515,073 | Estimate based on data returned by the Texas portal, not a Revolve total |

The lowest figure comes from state breach notices. The highest comes from Malwarebytes' search of Texas portal data, which returned up to 1,515,073 people. That is an estimate, not a company total. The Texas portal lists 127,200 residents, and those people are counted in the state notice total.

Revolve has not published a national total in the sources reviewed, so every number here is provisional. A fuller count from Revolve or a state regulator would settle the range.

## Who is affected by the Revolve data breach

The core group is US shoppers who saved a card on Revolve.com or FWRD.com. Guest checkouts and accounts without a stored card appear outside the reported exposure. People often forget whether they saved a card years ago, so check your account instead of guessing.

## What to do if you saved a card at Revolve

Start with the card itself. Most of the risk sits in the card number and expiration date, and a replacement card limits what a thief can do with the old one.

1. Check your account. Sign in directly at Revolve.com or FWRD.com, not through a link in an email, and see whether a payment card is saved.
2. Call your card issuer if you received a notice. Ask for the card to be canceled and replaced, and ask what fraud monitoring the issuer provides.
3. Review statements closely. Look for small charges as well as large ones, since test charges often start small. Report anything unfamiliar immediately, because fraud can begin within days of a breach.
4. Treat unexpected messages with suspicion. Phishing emails or texts that mention Revolve and ask for payment or login details are the kind of follow-on fraud to expect.
5. Consider a credit freeze if your notice lists identity data beyond card details. A freeze is free at each of the three major credit bureaus.

Revolve is not offering free identity theft or credit monitoring, according to PYMNTS. Before paying for a monitoring service, check whether your bank or card issuer already includes one.

Fraud built on a convincing message is not hypothetical. Our coverage of [three men charged in a $129 million AI CEO impersonation scam](https://usa-24.com/ai-ceo-impersonation-scam/) shows what a well-built request can achieve, so treat any message that asks for money or credentials with a second look.

## Why the Revolve timeline and the wider week matter

The timeline is the uncomfortable part. Revolve discovered the activity on Sept. 29, and its SEC filing came on Oct. 29, about a month later. Word reached shoppers in early November, which means many may have learned of the problem from the news rather than a letter. The sources reviewed do not explain the delay.

Breaches are stacking up across the industry. Chainalysis faced its own breach, which our [earlier report on credentials exposed for all users](https://usa-24.com/chainalysis-breach-all-users-credentials/) covers in detail. Security Boulevard's weekly roundup also listed a theft of an estimated €118 million from the French bank Crédit Mutuel Arkéa, carried out through a service provider.

Trusted channels are another common thread. [Cursor](https://cursor.com/blog/claude-code-extension-security-notice) said a malicious version of an Anthropic Claude Code extension, identified as 2.1.312 and 2.1.313, was available on its VS Code marketplace for about 11 hours in late October and could affect up to 5,000 users. Attackers keep targeting places people already trust, whether a shopping site, a code marketplace or a vendor's software.

## What comes next after the Revolve breach

Three questions will shape how serious this becomes. The first is the total. A national figure from Revolve, an updated filing or a state regulator's posting would replace the current range of estimates. The second is monitoring. Revolve has not offered free monitoring in the sources reviewed, and a change there would signal how seriously it treats the exposure. The third is cause. Revolve has not said how attackers got in, and no group has claimed the attack in the sources reviewed.

For shoppers, the next step is straightforward. Check whether your card is saved, replace it if you received a notice, and keep reviewing statements over the coming months, not only this week.

## Frequently asked questions

### Did Revolve get hacked?

Revolve disclosed in an SEC filing dated Oct. 29, 2026, that unauthorized parties accessed some of its systems, including its online shopping platform. Attackers may have taken names, addresses, card numbers and expiration dates for customers who saved payment cards. The company said it stopped the activity and notified federal law enforcement.

### How many people were affected by the Revolve data breach?

Estimates vary by source. State breach notices total at least 197,072 people, SecurityWeek reported that Revolve notified at least 200,000, and Malwarebytes estimated up to 1,515,073 based on Texas portal data. Revolve has not confirmed a national total.

### Was my Revolve card exposed?

Only customers who saved a payment card to their account appear affected. Check your account on Revolve.com or FWRD.com to see whether a card is saved. If you received a notice, contact your card issuer and ask for the card to be canceled and replaced.

### Does Revolve offer free credit monitoring after the breach?

Not according to the sources reviewed. PYMNTS reported that Revolve is not offering free identity theft or credit monitoring and advised customers to review statements and watch for fraud. Check whether your bank or card issuer already provides monitoring before paying for a service.

## Sources

1. [Revolve card breach: 1.5 million people may be affected — Malwarebytes](https://www.malwarebytes.com/blog/data-breaches/2026/11/revolve-card-breach-1-5-million-people-may-be-affected)
2. [Revolve Reports Breach of Fashion Retail Platform — PYMNTS](https://www.pymnts.com/cybersecurity/2026/revolve-reports-breach-fashion-retail-platform/)
3. [Saved a Card at Revolve? Hackers May Have Taken Your Payment Details — All About Cookies](https://allaboutcookies.org/revolve-data-breach)
4. [Revolve Data Breach Hits 1.5M: What to Do if You Got a Letter From Revolve — McAfee](https://www.mcafee.com/blogs/security-news/revolve-data-breach/)
5. [October 2026 Data Breaches and Key Lessons — Strobes](https://strobes.co/blog/top-data-breaches-october-2026/)
6. [Top 10 Breaches of the Week — Security Boulevard](https://securityboulevard.com/2026/11/top-10-breaches-of-the-week-15/)
7. [Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace — Cursor](https://cursor.com/blog/claude-code-extension-security-notice)