Online fashion retailer Revolve Group says an unauthorized actor may have obtained names, contact information, payment card numbers and expiration dates belonging to customers who saved payment details on its e-commerce platform.
In its October 29 SEC filing, the company said it had remediated the activity but was still assessing the incident.
Revolve’s California breach notice says an unauthorized actor accessed its shopping platform on September 11, 2026, and that the company determined on September 29 that the potentially involved data included names, addresses, card numbers and expiration dates. SecurityWeek’s updated review of state filings found that at least 197,072 people received notification letters.
The company said it notified federal law enforcement and hired outside cybersecurity experts. It reported no operational disruption or interruption to customer service and said it did not expect a material impact on its business. The SEC filing does not identify the attacker or explain the access method beyond saying the data may have been obtained through automated means.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
