BreachPublished 2 Nov 2026

Revolve Data Breach Impacts at Least 180,000 People

Source SecurityWeek

Description

In September 2026, online fashion retailer Revolve suffered a data breach impacting at least 180,000 customers. Hackers accessed the company's online shopping platform and stole personal information including names, addresses, payment card numbers, and expiration dates of customers who had saved this data. The breach did not disrupt operations or customer service. Revolve promptly initiated incident response, contained the breach, and engaged law enforcement and cybersecurity experts. Affected individuals were notified but were not offered free credit monitoring services. The company has not disclosed the attacker identity or attack method.

Impact

The breach exposed sensitive personal and payment card data of approximately 180,000 customers, increasing the risk of identity theft and payment fraud for those individuals. There was no reported disruption to Revolve's services or operations. The company does not expect a material impact on its business. However, affected customers face potential financial and privacy risks due to the data exposure.

Defensive guidance

Revolve has contained the unauthorized access and engaged law enforcement and cybersecurity experts for remediation. Affected individuals have been notified to remain vigilant for fraud or identity theft. The company has not offered free credit monitoring services. Customers should monitor their financial statements and report suspicious activity promptly. No additional mitigation steps have been disclosed by the vendor.

Summary

The Revolve data breach involved unauthorized access to the company's e-commerce platform on September 11, 2026, resulting in exfiltration of personal and payment card information of at least 180,000 customers. The compromised data included names, addresses, payment card numbers, and expiration dates for customers who stored this information on their accounts. Revolve detected the breach, contained the unauthorized activity, and engaged external cybersecurity assistance. Notifications were sent to affected individuals per regulatory requirements. No operational disruption occurred, and the company does not anticipate material business impact. Details on the attack vector or threat actors have not been disclosed.

References

securityweek.com/revolve-data-breach-impacts-at-least-180000-people/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Nov 2026, 13:43 UTC

Technical details

References

Community reviews