Revolve says unauthorized party may have taken stored customer payment card data

Revolve Group (NYSE: RVLV) disclosed Oct. 29, 2026 that an unauthorized party may have taken stored payment card information from customer accounts on its shopping site, according to the company’s Form 8-K filing with the U.S. Securities and Exchange Commission.

Vermont’s attorney general office recorded 1,328 affected state residents in its Oct. 29, 2026 notice. Data Breach Rights says the Vermont filing does not disclose the total number of people affected. The office filed the notice the same day as the SEC disclosure. The potential exposure applies only to shoppers who saved payment information in a Revolve online account.

The filing does not list card security codes, commonly called CVVs, among the data involved. The absence of CVVs matters for online-fraud feasibility. The Vermont filing flags financial account codes and credit and debit card details as exposed data types.

Revolve’s Form 8-K filing states that the company “recently became aware of unauthorized access to certain of its systems,” and the SEC filing says Revolve recently learned that someone had accessed certain of its systems without authorization. Revolve has not publicly defined what automated means refers to in this incident, though the filing describes the activity as occurring “through automated means.” A key unanswered question about the attack technique remains unresolved.

Revolve says it began incident response, stopped the activity, informed federal law enforcement, and engaged external cybersecurity experts. The company says operations continued, and customer service was not interrupted by the incident. It also says it does not expect the incident to harm its business results materially.

As of Oct. 30, 2026, Emery Reddy says it has not found notice letters for individuals or state attorney general filings tied to the incident. The reviewer’s inability to locate the filings creates uncertainty about the state notices.

In card-not-present fraud, a thief can try to use a card number, an expiration date, a cardholder name and contact details without ever presenting the physical card. The exposed fields enable online fraud even without CVVs. Fraudsters frequently test a stolen card with a small charge before attempting larger purchases. Unfamiliar merchant names on a statement can signal fraudulent use of a stolen card.

Card fraud can appear within days of a breach. Phishing messages built from real account details can arrive months later.

A scammer with a name, e-mail, and part of a real card number can write convincing fake Revolve or bank messages. The exposed data creates a secondary phishing risk. Fake messages could use real account details to appear legitimate.

Emery Reddy says cardholders can dispute unauthorized charges through their card issuer, and that quick reporting helps. Requesting a new card with a different number stops use of the old number. Reversing a fraudulent charge does not end the work: cardholders still face bank calls, a replacement card, and updating linked accounts and automatic payments. The cleanup burden falls on the cardholder.