Revolve Group warns customers' saved payment card data may have been stolen

On 29 October 2026, Revolve Group — the Cerritos, California-based online fashion retailer behind the Revolve and FWRD e-commerce brands — disclosed in a filing with the U.S. Securities and Exchange Commission that an unauthorised actor may have obtained the payment card data of customers who had saved their card details to their online shopping accounts. The company said it had recently become aware of the activity and promptly activated its incident response procedures.

What may have been exposed

According to the Form 8-K, Revolve believes the attacker may have obtained — "through automated means" — the name, contact information, payment card number and payment card expiration date for certain customers. The filing does not mention card security codes (CVV), and the company did not disclose how many customers were affected. The reference to automated collection is consistent with the kind of web-based payment-data theft that targets the checkout and stored-card functions of e-commerce platforms, though Revolve did not publish a technical description of the method.

Response

Revolve said it had initiated its cyber incident response protocols, confirmed that the unauthorised activity had been remediated, assessed the scope of the incident, implemented enhanced security measures, engaged external cybersecurity experts and notified federal law enforcement. The company reported the matter to the Vermont Attorney General the same day it filed with the SEC. It said the incident caused no operational disruption and did not interrupt service to customers.

Impact

As of the filing date, Revolve said it did not believe the incident would have a material impact on its business, while cautioning that its assessment was ongoing and that legal, regulatory, reputational and financial consequences remained possible. Because the exposed fields reportedly include full card numbers and expiry dates, affected customers were advised to monitor their card statements and consider asking their card issuer to replace any card saved on the retailer's site.