Revolve told the Securities and Exchange Commission on Thursday that hackers stole payment card numbers and card expiration dates from shoppers who had saved their cards to their accounts. On Friday, the company told Texas regulators that 127,200 residents had information taken. No national total has been published.
The disclosure came in an 8-K, the current-report form public companies file with the SEC. USA 24 did not have access to the filing itself. The details here come from The Record’s reporting, which includes the Texas figure, and from a breach tracker entry that lists the incident as a SEV 3 data breach dated October 30. Treat the figures as reported until the filing has been checked.
What the attackers took
According to the filing as The Record describes it, Revolve’s initial investigation found that the attackers used “automated means” to pull data from customers who had saved payment information on the company’s e-commerce platform. The reporting names four data types:
- Names
- Contact details
- Payment card numbers
- Card expiration dates
Card security codes are not on that list. The reporting does not say whether they were accessed, so readers should not assume the exposed set is limited to those four fields until the filing confirms it.
Replacing the card is the most direct way to make a stolen number useless, which is why the call to the issuer is the first step in the checklist below. A card number paired with an expiration date carries more immediate fraud risk than a name and email address alone.
Revolve’s filing also leaves basic questions open. It did not say when the attack happened, and it did not give a total number of affected people. Cybersecurity incidents a company judges to be material fall under Item 1.05 of Form 8-K, a disclosure rule the SEC adopted in 2023. That rule asks companies to describe the material aspects of an incident’s nature, scope and timing, so the missing timing detail is worth watching in any follow-up filing.
Which Revolve shoppers are affected
Only one figure is confirmed. Revolve told Texas regulators that 127,200 people in that state had information stolen, one day after its SEC filing. The national total is unknown, and the reporting does not give a count for any other state.
Texas is the only state named in the reporting. Shoppers elsewhere should not treat the Texas number as a ceiling, because the filing does not say how many customers live outside the state.
As described, the affected group is customers who saved payment information in their accounts. The reporting does not say whether shoppers who checked out without saving a card were included. Because names and contact details are also on the exposed list, anyone who has used a Revolve account should watch for targeted phishing.
Where Revolve fits in a difficult October
The Record places the incident within a wider run of breaches that Just Security calls “Black October.” Fashion retail has been a repeat target. The Record notes that ASOS, Levi Strauss, Mango and North Face all faced attacks over the past two years.
ASOS’s own October incident is the closest recent comparison. The company linked its breach to a social-engineering attack that stole an employee’s login credentials, and it said payment card data and passwords were not accessed. Revolve’s filing describes a different outcome, since card numbers and expiration dates were taken. Revolve has not said how its attackers got in, so readers should not assume the ASOS attack path applies.
Compared with earlier retail breaches, the most important detail is the data type rather than the headline count. Full card numbers with expiration dates demand faster action from shoppers than most contact-data leaks do, which is why card-data disclosures usually produce more urgent advice.
Dollar figures elsewhere this month are far larger. USA 24 has covered the Binance hack, which is measured in billions. The Revolve case is smaller in dollars, but it lands on ordinary shoppers and their everyday cards.
Who bears the cost is fairly clear. Shoppers with stored cards carry the hassle of replacing them and checking statements. Revolve faces disclosure obligations, customer notices and questions about its security. Most US card networks limit a cardholder’s liability for unauthorized charges, but that protection generally depends on reporting fraud promptly.
Other recent cases point the same way. USA 24 has reported on a Quest Diagnostics breach that exposed patient records through the Quanum platform, and on a Chainalysis breach in which hackers accessed customer data. The common thread is personal data held by a company that attackers can reach.
What Revolve shoppers should do now
The steps below are general guidance, not instructions from Revolve or the filing. If you receive a notice letter from the company, follow its instructions first.
- Check recent card statements for charges you do not recognize, including small test charges.
- If you saved a Revolve card, call your card issuer and ask for a replacement card number.
- Turn on transaction alerts in your bank or card app so you see purchases as they post.
- Remove saved cards from your Revolve account and use another payment method until you have a new card.
- Treat messages about “your Revolve order” as possible phishing. Go directly to the official site or app instead of clicking links.
- Report unfamiliar charges to your card issuer quickly, since prompt reporting is what protects you under most card liability rules.
What to watch next
Three questions will shape how large this gets. First, the full 8-K text should confirm when the intrusion began and when Revolve found it. Second, notices filed in other states should show whether the Texas figure is a small part of a larger total. Third, Revolve needs to explain how the attackers got in, which tells other retailers whether their own checkout systems face the same risk.
A separate problem is also unresolved. A cyber incident at BAE Systems has disrupted bankruptcy notices from US courts since October 9, and the reporting does not give a restoration date, according to SecurityWeek and eSecurityPlanet. It is unrelated to Revolve, but it is another reminder that a single breach can slow notices people depend on.
The next signal will come from the notice letters Revolve sends and any revised count it files. Those documents will show whether the Texas number is the first piece of a larger picture, and they will tell shoppers whether a saved card needs replacing now or can wait.
