Revolve Data Breach

Revolve, the online fashion retailer, says a hacker may have taken the card numbers and expiration dates that shoppers saved in their accounts. Shoppers who saved a card with Revolve may see unauthorized charges. The company has not said how many customers are affected.

Revolve Group, Inc. disclosed the incident in a Form 8-K filed with the U.S. Securities and Exchange Commission (SEC) on Oct. 29, 2026. In the filing, Revolve said it “recently became aware of unauthorized access to certain of its systems.” The company said it started its incident response process, confirmed the activity was stopped, notified federal law enforcement and hired outside cybersecurity experts to investigate.

Based on that investigation, Revolve believes an unauthorized person may have obtained the name, contact information, payment card number and payment card expiration date of certain customers. The affected group is customers who saved payment information in their online shopping account on Revolve’s e-commerce site.

Emery | Reddy is investigating the Revolve data breach on behalf of customers who may be affected.

Revolve Shoppers May See Unauthorized Charges

The most immediate risk in this breach is fraud on the cards themselves. A card number, expiration date, cardholder name and contact information are the core details needed to attempt a purchase online, where the physical card is never shown. Affected shoppers may see charges they did not make on any card they saved with Revolve.

Fraudulent charges do not always look obvious. Criminals often start with a small charge to test whether a stolen card still works, then make larger purchases. Charges may also show up under a merchant name the cardholder does not recognize.

Card issuers have a process for disputing unauthorized charges, and reporting them quickly helps. Affected shoppers can also ask the issuer to cancel the card and send a new one with a different number, which stops the old number from being used.

Even when a bank reverses a fraudulent charge, the cleanup takes time: calls to the bank, a replacement card, and updating every account and automatic payment tied to the old card number.

Why Saved Card Data Is a Bigger Problem Than It Sounds

Many shoppers save a card to check out faster. That convenience means the retailer stores the card details on its own systems. In this case, Revolve’s filing says the card number and expiration date may have been taken together with each customer’s name and contact information.

Beyond unauthorized charges, the same details create a second risk. A scammer who knows a person’s name, email and the last digits of a real card can write very convincing fake messages that look like they came from Revolve or a bank.

Revolve’s filing says the information may have been taken “through automated means.” The filing does not explain what that means. It also does not list card security codes (CVV) among the data involved.

What Revolve Has Not Said Yet

The 8-K leaves several key questions open:

• How many customers were affected
• When the unauthorized access started and when Revolve discovered it
• How long the access lasted
• Whether Revolve will offer credit or identity monitoring

Revolve also said the incident did not disrupt its operations and that, as of the filing date, it does not expect the incident to have a material impact on its business. As of Oct. 30, 2026, Emery | Reddy has not located individual notice letters or state attorney general filings for this incident.

What Information Was Exposed?

According to Revolve’s SEC filing, the information that may have been obtained includes:

• Name
• Contact information
• Payment card number
• Payment card expiration date

The filing describes this information only for customers who saved payment details in their online account.

What Is Revolve Offering Affected Customers?

Revolve has not publicly said whether it will offer credit monitoring or any other services. Customers who receive a notice letter should read it closely for any enrollment instructions and deadlines.

Your Card and Your Identity Are at Risk

Payment card fraud can happen fast, sometimes within days of a breach. Phishing that uses real account details can follow for months. Affected customers face a risk of unauthorized charges, fake “fraud alert” messages and other scams that use the stolen details.

Steps that reduce the risk:

• Review statements line by line for any card saved at Revolve, including small charges
• Report any charge not recognized to the card issuer right away
• Ask the card issuer about a replacement card with a new number
• Turn on purchase alerts with the card issuer
• Keep records of fraudulent charges, replacement cards and time spent fixing accounts
• Treat unexpected emails or texts about a Revolve order or refund with caution

Do You Have Legal Options?

Retailers that store customers’ payment cards have a duty to protect that information. When a company fails to keep payment data secure, affected customers, including those dealing with unauthorized charges, replacement cards and time spent fixing their accounts, may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Frequently Asked Questions

How many people were affected by the Revolve data breach?

Revolve has not disclosed a number. Its SEC filing says only that “certain customers” who saved payment information in their online account may be affected.

What information was exposed in the Revolve breach?

According to Revolve’s 8-K filing, the information that may have been obtained includes:

• Name
• Contact information
• Payment card number
• Payment card expiration date

I shop at Revolve but never saved a card. Am I affected?

The filing describes the payment card exposure only for customers who saved payment information in their account. If you never saved a card, your card number may not be involved, but Revolve has not released full details. Watch for a notice letter or email from Revolve.

Could I see unauthorized charges on my card?

Yes, it is possible. Revolve says card numbers and expiration dates saved in customer accounts may have been taken, along with names and contact information. Those details can be used to try online purchases. Check your statements for any charge you did not make, including small ones.

What should I do if I see a charge I did not make?

Act right away:

• Call the number on the back of your card and report the charge
• Ask for the card to be canceled and replaced with a new number
• Write down the date, amount and merchant of each fraudulent charge
• Keep copies of your dispute and any letters from Revolve

When did the Revolve breach happen?

Revolve has not said. The company reported the incident to the SEC on Oct. 29, 2026, and said it “recently became aware” of the unauthorized access.

What should I do if I saved a card with Revolve?

Review your card statements now and for the next several months.

• Ask your card issuer whether you should get a new card number
• Set up text or email alerts for every purchase
• Report any charge you do not recognize right away
• Keep any notice you receive from Revolve

How can I spot a scam that uses this breach?

Criminals often send messages that mention a real data breach by name. Be careful with any email, text or call that asks you to “verify” your card, claims a refund is waiting, or pushes you to click a link quickly. Go directly to Revolve’s website or your bank’s app instead of using links in a message.

Do I have a legal claim?

Companies that collect and store payment card information have a duty to protect it and to tell customers promptly when it is exposed. If your information was involved in the Revolve data breach, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.