Online fashion retailer Revolve Group has disclosed a major cybersecurity breach affecting approximately 1,515,073 individuals nationwide. The September 11, 2026, cyberattack exposed sensitive customer information, including names, addresses, complete payment-card numbers and expiration dates. According to regulatory filings, 127,200 Texas residents were affected, along with thousands of customers in Massachusetts, Iowa and Vermont. The unauthorized access was discovered on September 29, and customer notifications began on October 29.
ATTACKERS USED AUTOMATED METHODS TO EXTRACT PAYMENT DATA
Revolve confirmed that an unauthorized actor accessed company systems and potentially collected stored customer payment information using automated methods. The company has not disclosed how the attacker gained access, whether a software vulnerability was exploited or how long the intrusion lasted. Revolve initiated its incident-response procedures, engaged cybersecurity specialists, notified federal law enforcement and remediated the unauthorized activity. Despite the scale of the breach, the retailer reported no operational disruptions and does not expect a material financial impact.
EXPOSED CREDIT CARD INFORMATION RAISES FRAUD CONCERNS
The exposure of complete payment-card numbers creates significant risks of unauthorized purchases, card-testing attacks and targeted phishing campaigns. Affected customers should contact their card issuers, consider replacing compromised cards, enable transaction alerts and monitor accounts for suspicious activity. Cybersecurity professionals recommend that e-commerce businesses strengthen payment-data protection through tokenization, network segmentation, restricted database access and automated monitoring for unusual data extraction. The Revolve breach highlights how automated attacks against stored payment information can expose millions of consumers to financial fraud.