Business Fortune: Revolve Group Data Breach, Cards Exposed

Revolve Group Data Breach: What Saved-Card Shoppers Need to Do Now

The Revolve Group data breach may have exposed saved card details of REVOLVE and FWRD shoppers. Here are the facts and next steps.

Revolve Group says it could be a third party has accessed the payment card details, including stored card numbers, expiry dates and contact details of Revolve Group customers from REVOLVE and FWRD. At least 197,072 people have been notified via letter about the breach.

Overview: The breach, which occurred on 11 September 2026, was discovered on 29 September. It was announced in an SEC filing on 29 October. Only those customers that had saved their card details to their account will be impacted.

Who has been impacted?

Those customers who had saved their payment details to their REVOLVE/FWRD account. This includes name, address/contact details, card number and expiry date. There is no mention of card security codes in the summary of the SEC filing.

Revolve have not released a total figure. The filings to the Attorneys General for Iowa, Massachusetts, South Carolina, Texas and Vermont show at least 197,072 customers have been impacted. Of this, 127,200 customers were from Texas.

How did the breach occur?

Revolve has not said how the breach occurred. However, in the filing it says the breach was gained "by automated means". No groups have claimed responsibility.

The company says that they have confirmed the activity has been resolved, alerted federal law enforcement and hired third-party cybersecurity experts.

Is Revolve still trading as normal?

Yes, the company told the SEC that there has been "no disruption to operations." They also say they do not expect any material impact to their business. The company is listed on the NYSE under the ticker RVLV. They run both REVOLVE and FWRD.

When was the breach announced?

The breach was announced on 29 October. The 8-K was filed on this day. A notice was added to the breach list of the Vermont Attorney General. Filings were made to Texas, Massachusetts, Iowa and California.

There was a seven week gap between the breach occurring and being announced.

What should customers do?

Check their card statements. Revolve have sent out letters telling customers to contact their card provider immediately if they have seen unauthorised charges. They also give advice on setting up fraud alerts and freezing credit. Details are provided to contact the three main credit referencing agencies and the FTC.

Revolve are not offering free credit monitoring. Customers can contact the call centre if they have any questions. Many customers will want to ask their card provider for a new card number. Removing stored cards from infrequently used retail accounts will also reduce the risk.

More to Know

Revolve Group run both REVOLVE and FWRD.

The breach occurred on 11 September 2026. It was discovered on 29 September.

A Form 8-K was filed with the SEC on 29 October 2026.

The data compromised includes name, contact details, card number and expiry date.

127,200 customers in Texas, 46,813 customers in Massachusetts, 3,918 customers in Iowa, 1,328 customers in Vermont (total of 179,259) and South Carolina. This totals to at least 197,072.

Federal law enforcement has been alerted and third-party cybersecurity experts have been hired.

Operations have not been disrupted.

They are not offering free credit monitoring.

Although having stored cards makes checkout easier, this breach shows why it can be risky. Whilst Revolve have contained the breach, there are still questions around how many people were impacted, how the breach occurred and why it took so long to announce. Business Fortune tells readers, if you have stored your card, keep an eye on your statements and contact your card provider.