Revolve is notifying shoppers that an intruder may have obtained personal information and saved payment card details from its online shopping platform. The retailer has contained the unauthorized activity, but affected customers still need to check what their individual notices say.
In an October 29 filing with the SEC, Revolve said the actor may have collected names, contact information, card numbers and expiration dates through automated means. The disclosure concerns certain customers who had saved payment information in their shopping accounts; it does not establish that every Revolve customer was affected.
A September incident, with notices now reaching shoppers
The customer notification filed in California places the unauthorized access on September 11, 2026. Revolve says it determined on September 29 which personal and payment information was involved. Those dates describe the incident and the investigation, rather than a new attack in November.
SecurityWeek’s updated reporting counted at least 197,072 notification letters across filings in Iowa, Massachusetts, South Carolina, Texas and Vermont. That is a tally from those state notices, not a final worldwide total confirmed by Revolve.
Revolve said it brought in outside cybersecurity specialists and notified federal law enforcement. Its October 29 filing reported no operational disruption or interruption to customer service. The company has not publicly identified the intruder or explained the initial access method.
What the notice asks customers to do
Revolve’s letter advises recipients to review payment card statements and promptly report unfamiliar charges to their card issuer. The individual notice identifies the relevant card by its last four digits, giving recipients a way to check which account the warning concerns.
The public disclosures do not establish that every exposed card has been used fraudulently. For customers, the distinction matters: a notification describes possible exposure, while a transaction they do not recognize requires attention from the issuer.
Sources: Revolve SEC filing; Revolve customer notification, California DOJ; SecurityWeek reporting, updated November 3.
Image: AI-generated editorial illustration created for DaySec, not a photograph of the incident.
