Breach · · 3 min read
Revolve says saved card numbers may have been taken from shopper accounts
Online fashion retailer Revolve says an intruder may have collected names, contact details, card numbers and expiry dates of customers who saved a card. What to do.
Revolve, the US online fashion retailer, says someone got into some of its systems and may have collected the payment cards customers had saved to their accounts. If you shop with Revolve and kept a card on file, here’s what the company has said and what to do about it.
What happened
In a filing with the US Securities and Exchange Commission dated October 29, 2026, Revolve Group said it “recently became aware of unauthorized access to certain of its systems.” It believes an unauthorized actor “may have obtained, through automated means” the name, contact information, payment card number and card expiration date of certain customers who saved payment information in their online shopping account.
Revolve says it has stopped the unauthorized activity, notified federal law enforcement, brought in outside cybersecurity experts and added security measures. It says the incident didn’t disrupt its service.
The filing doesn’t say when the access happened, how the intruder got in or how many customers are affected. The Record reports that Revolve told Texas regulators 127,200 people in that state were affected, that 1,328 were listed in Vermont and that notices were filed in Massachusetts. Those are state counts, not a total.
The filing doesn’t mention card security codes or passwords. It also doesn’t say whether the card numbers were complete.
What this means for you
A card number with its expiry date is enough to attempt some online purchases, so the card itself is what matters most here. Your name and contact details also make it easier for someone to send a message that looks like it’s from Revolve or your bank.
What you can do
- Replace the card you saved. Call the number on the back of the card or use your bank’s own app and ask for a new card number. That makes the old number useless, whatever was taken.
- Watch your statements. Look for charges you don’t recognize, small ones included, and report them to your card issuer right away.
- Be careful with “Revolve” or “bank” messages. Don’t share card details or one-time codes with someone who contacted you first. Sign in to your account by typing the address yourself.
- Keep fewer saved cards. Remove cards from shopping accounts you rarely use, so a future breach has less to take.
How Frame helps
Frame keeps a catalog of known breaches. Add the ones you know you were part of to a verified email and Frame shows what each exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame’s email aliases also let you give each store its own address, which makes a message to the wrong address an easy sign of a fake. Frame never collects or stores the leaked records themselves.
Sources
- Revolve Group, Inc., Form 8-K, U.S. Securities and Exchange Commission, October 29, 2026
- The Record, Fashion retailer Resolve says hackers stole payment card information (the headline misspells Revolve), October 30, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.