Saved payment cards at Revolve may have been exposed in an attack that began in September, and the company has not published a national count of affected customers. Public estimates now run from at least 197,072 people to as many as 1,515,073, and the figures come from different kinds of records.
The breach surfaced in a Securities and Exchange Commission filing dated Oct. 29, 2026. In it, Revolve said some of its systems, including its online shopping platform, were accessed without authorization, according to All About Cookies. The company said it stopped the activity, strengthened security, notified federal law enforcement and hired outside cybersecurity experts, and that operations were not disrupted.
The story reached a wider audience in early November. PYMNTS and SecurityWeek reported the notifications, and on Nov. 3 Malwarebytes published its 1.5 million estimate. The attack itself is older. Texas filing records list the breach date as Sept. 11, 2026 and the discovery date as Sept. 29, 2026, according to Malwarebytes and McAfee.
Revolve data breach: what data may have been taken
The exposure is narrower than a full customer database. According to SecurityWeek's reporting, as relayed by PYMNTS, attackers may have taken names, addresses, payment card numbers and expiration dates, but only for customers who saved payment cards to their accounts.
Malwarebytes noted that the SEC filing does not mention card verification value (CVV) numbers. Many online merchants ask for that code in addition to the card number, so its absence narrows the risk. Card numbers, expiration dates and names still give criminals material for phishing and small test charges, which is why the cards themselves need attention.
Revolve says it does not know how attackers obtained the saved payment data. The filing, as quoted by Malwarebytes, says an unauthorized actor may have obtained the data "through automated means." That phrase could point to scripted access rather than a single targeted intrusion, but the company has not described the method or the extra safeguards it added.
How many people the Revolve breach affected
Three figures are in circulation, and they do not measure the same thing. The table below lists each one and what it is based on.
| Source | Figure | What it measures |
|---|---|---|
| SecurityWeek, as reported by PYMNTS | At least 200,000 | People Revolve notified |
| Strobes roundup of state notices | At least 197,072 | People across state breach notices, including 127,200 in Texas |
| Malwarebytes, from Texas portal data | Up to 1,515,073 | Estimate based on data returned by the Texas portal, not a Revolve total |
The lowest figure comes from state breach notices. The highest comes from Malwarebytes' search of Texas portal data, which returned up to 1,515,073 people. That is an estimate, not a company total. The Texas portal lists 127,200 residents, and those people are counted in the state notice total.
Revolve has not published a national total in the sources reviewed, so every number here is provisional. A fuller count from Revolve or a state regulator would settle the range.
Who is affected by the Revolve data breach
The core group is US shoppers who saved a card on Revolve.com or FWRD.com. Guest checkouts and accounts without a stored card appear outside the reported exposure. People often forget whether they saved a card years ago, so check your account instead of guessing.
What to do if you saved a card at Revolve
Start with the card itself. Most of the risk sits in the card number and expiration date, and a replacement card limits what a thief can do with the old one.
- Check your account. Sign in directly at Revolve.com or FWRD.com, not through a link in an email, and see whether a payment card is saved.
- Call your card issuer if you received a notice. Ask for the card to be canceled and replaced, and ask what fraud monitoring the issuer provides.
- Review statements closely. Look for small charges as well as large ones, since test charges often start small. Report anything unfamiliar immediately, because fraud can begin within days of a breach.
- Treat unexpected messages with suspicion. Phishing emails or texts that mention Revolve and ask for payment or login details are the kind of follow-on fraud to expect.
- Consider a credit freeze if your notice lists identity data beyond card details. A freeze is free at each of the three major credit bureaus.
Revolve is not offering free identity theft or credit monitoring, according to PYMNTS. Before paying for a monitoring service, check whether your bank or card issuer already includes one.
Fraud built on a convincing message is not hypothetical. Our coverage of three men charged in a $129 million AI CEO impersonation scam shows what a well-built request can achieve, so treat any message that asks for money or credentials with a second look.
Why the Revolve timeline and the wider week matter
The timeline is the uncomfortable part. Revolve discovered the activity on Sept. 29, and its SEC filing came on Oct. 29, about a month later. Word reached shoppers in early November, which means many may have learned of the problem from the news rather than a letter. The sources reviewed do not explain the delay.
Breaches are stacking up across the industry. Chainalysis faced its own breach, which our earlier report on credentials exposed for all users covers in detail. Security Boulevard's weekly roundup also listed a theft of an estimated €118 million from the French bank Crédit Mutuel Arkéa, carried out through a service provider.
Trusted channels are another common thread. Cursor said a malicious version of an Anthropic Claude Code extension, identified as 2.1.312 and 2.1.313, was available on its VS Code marketplace for about 11 hours in late October and could affect up to 5,000 users. Attackers keep targeting places people already trust, whether a shopping site, a code marketplace or a vendor's software.
What comes next after the Revolve breach
Three questions will shape how serious this becomes. The first is the total. A national figure from Revolve, an updated filing or a state regulator's posting would replace the current range of estimates. The second is monitoring. Revolve has not offered free monitoring in the sources reviewed, and a change there would signal how seriously it treats the exposure. The third is cause. Revolve has not said how attackers got in, and no group has claimed the attack in the sources reviewed.
For shoppers, the next step is straightforward. Check whether your card is saved, replace it if you received a notice, and keep reviewing statements over the coming months, not only this week.
