A major data breach involving Revolve Group, the parent company of online fashion retailers Revolve and FWRD, has potentially exposed sensitive customer information belonging to 1,515,073 individuals nationwide, including 127,200 Texas residents. According to a regulatory filing with the Texas Attorney General, the compromised information included customer names, contact details, payment-card numbers and expiration dates. The incident raises concerns about financial fraud and the security of stored payment information across e-commerce platforms.
ATTACK TARGETED SAVED PAYMENT INFORMATION
The cyberattack targeted payment information saved in customers’ online shopping accounts. Revolve disclosed that an unauthorized actor may have used automated methods to collect customer names, addresses, card numbers and expiration dates. The company has not reported exposure of passwords, Social Security numbers or card security codes. Investigators have not publicly identified the attacker or determined how the unauthorized access occurred.
BREACH OCCURRED ON SEPTEMBER 11
The unauthorized access occurred on September 11, 2026, and Revolve determined the potentially affected information on September 29. The company began notifying customers and filing regulatory disclosures in late October, including an October 29 SEC filing. Revolve confirmed that it contained and remediated the unauthorized activity, notified federal law enforcement and engaged external cybersecurity specialists. The incident reportedly caused no operational disruptions or interruptions to customer service.
CUSTOMERS URGED TO REPLACE EXPOSED PAYMENT CARDS
Affected Revolve and FWRD customers should contact their financial institutions to request replacement payment cards and monitor accounts for unauthorized transactions. Cybersecurity experts also recommend remaining alert for phishing messages impersonating retailers, banks or delivery services. For online retailers, the breach highlights the importance of payment tokenization, stronger access controls and automated monitoring to detect suspicious collection of customer information before widespread exposure occurs.