Revolve says hackers stole payment card data from shoppers

Hackers stole payment card data from Revolve’s e-commerce platform, the company reported on Oct. 30, 2026, exposing 127,200 customers in Texas and 1,328 in Vermont, with breach notifications also filed in Massachusetts.

Revolve, a fashion retailer that targets Millennial and Gen Z consumers, said the stolen information covers names, contact information, payment card numbers and expiration dates for customers who saved payment details on its platform. The retailer described the access as automated entry into customer accounts and said the breach emerged during an initial investigation. The company did not disclose a total number of affected customers nationwide.

Revolve disclosed the breach to the U.S. Securities and Exchange Commission in an 8-K filing on Oct. 26, 2026. The filing confirmed that hackers accessed multiple company systems. In the filing, Revolve warned investors: “Revolve warned investors that cybercriminals gained access to payment card numbers and expiration dates during a recent cyber incident.”

Revolve reported $347.4 million in net sales in its last fiscal quarter and works with over 1,600 brands in apparel, footwear and accessories. The company was founded in 2023 and describes itself as a next-generation fashion retailer for Millennials and Gen Z customers. It offers apparel, footwear and accessories through its platform.

Revolve said the breach caused no operational disruptions and no material financial impacts, according to its SEC filing. The company emphasized that no operational disruptions occurred as a result of the incident. It has notified federal law enforcement about the breach and hired a cybersecurity firm to lead recovery efforts.

Payment card data thefts at fashion retailers remain a persistent cybercrime trend, with major brands including ASOS, Levi Strauss, Foschini Group, Mango, North Face, Harrods, M&S and The Co-op targeted in recent years, according to the reporting. This pattern underscores the ongoing risk to customer financial data in the retail sector.

According to UpGuard, retailers can face GDPR fines of up to €20 million or 4% of global annual turnover for breaches involving European customers. California’s CCPA permits statutory damages of $100–$750 per consumer when a breach exposes unencrypted personal data. Regulatory penalties and class-action lawsuits can impose significant financial burdens on affected companies.

According to UpGuard, the Payment Card Industry Data Security Standard version 4.0.1 (Mar. 31, 2025) requires retailers to use multifactor authentication for all access to cardholder data environments (systems that store or process payment card data) and to monitor payment pages continuously to block skimming attacks (stealing payment card data from payment pages). Non-compliance can bring regulatory fines and legal consequences.

Affected customers should contact their bank or credit card provider immediately to request a replacement card and monitor accounts for unauthorized transactions, according to breach-response guidance cited by Daily Security Review. Customers should also check bank statements and credit reports regularly for suspicious activity and avoid responding to phishing attempts tied to the breach. Proactive steps can mitigate the risk of fraud following a data breach. Vigilance is critical to preventing identity theft and financial fraud.