← Articles and guides on fraud, cybersecurity, privacy and AML
Revolve data breach: saved payment cards exposed, what to do
Fashion retailer Revolve told the SEC that saved payment card data may have been taken. What leaked, who is affected and the steps to protect yourself.
Online fashion retailer Revolve Group disclosed in an SEC Form 8-K dated October 29, 2026 that an unauthorized actor may have obtained, "through automated means," data for certain customers who saved payment cards to their online shopping accounts.
What data was exposed in the Revolve breach?
Name, contact information (the customer letter cites address), payment card number and expiration date. The filings do not mention card security codes (CVV) and do not say how many customers were affected or when the intrusion happened. Revolve says it activated its incident response protocols, remediated the activity, hired outside experts and notified federal law enforcement, with no service disruption and no expected material impact.
Why an Item 8.01 filing?
Revolve used Item 8.01 (other events) rather than Item 1.05, which is reserved for incidents a company deems material. See what the SEC 8-K rule revealed.
| Item | Status |
|---|---|
| Affected customers | Not disclosed |
| CVV | Not mentioned |
| Credit monitoring | Not offered in the template letter |
| Support line | 888-517-6458, Mon–Fri, 9 a.m.–9 p.m. ET |
What should Revolve customers do?
- Review statements for the saved card and dispute unknown charges; consider asking your bank for a new card.
- Delete saved cards from stores you rarely use and use virtual cards and purchase alerts.
- Change your Revolve password and any reused passwords; watch for phishing about the incident.
- Get free credit reports at annualcreditreport.com, consider a free fraud alert or security freeze at the three bureaus, and report identity theft at identitytheft.gov.
Automated attacks such as credential stuffing are common, though Revolve has not named the method. Follow the Radar and US breach rules.
How do SEC cyber disclosures work?
Under the SEC rule, public companies report cybersecurity incidents they consider material under Item 1.05 of Form 8-K, within four business days of determining materiality. In May 2024, SEC staff encouraged companies to use Item 8.01 for voluntary disclosures of incidents not yet judged material, or judged immaterial. That is the route Revolve took, which is why the filing contains few details and no customer count.
Who is affected?
Customers who saved a payment card in their Revolve online account. Because the store sells internationally, that can include shoppers outside the US. The company says affected customers are being notified by letter; the Massachusetts template does not offer credit monitoring but lists a support line. People who never saved a card are outside the group Revolve described, though changing a reused password is still wise.
The lesson
The most valuable data for a criminal is not always the password; it is the card kept for convenience. With holiday shopping season approaching, store fewer cards, use virtual numbers and turn on purchase alerts. See virtual cards and alerts and what to do after a breach.
Source
- SEC — Revolve Group, Form 8-K (29/10/2026)
- Massachusetts AG — Revolve Group data breach notice
- BCLP — SEC staff guidance on Item 1.05 vs Item 8.01 (2024)