Revolve Group, the Los Angeles-area online fashion retailer that trades on the NYSE as RVLV, has disclosed that an unauthorized party got into some of its systems and may have taken payment card data belonging to customers who saved a card in their shopping account. The company reported the incident in a Form 8-K dated October 29, 2026.

The filing gives no victim count and no date for the intrusion. Breach notices filed with state regulators fill in part of the picture. According to The Record, Revolve told Texas regulators that 127,200 people in the state had information stolen, and it reported 1,328 affected people in Vermont. The Record says notifications were also filed in Massachusetts. (The Record's headline spells the company "Resolve." The company is Revolve Group, Inc.)

Below is what is known, what is still missing, and what customers and security teams should do.

What did Revolve actually say?

The 8-K is brief. Revolve says it "recently became aware of unauthorized access to certain of its systems." It says it confirmed the unauthorized activity was remediated, notified federal law enforcement, and engaged external cybersecurity experts. The central sentence describes the data at risk: the company believes an unauthorized actor "may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information associated with their online shopping account" on its e-commerce platform.

Revolve also says the incident did not cause operational disruption or interrupt service to customers, and that it does not believe the incident will have a material impact on its business. TradingView's summary of the filing adds that the company has implemented enhanced security measures.

Why is this an Item 8.01 filing and not Item 1.05?

Since late 2023, SEC rules have required public companies to report material cybersecurity incidents under Item 1.05 of Form 8-K. Item 8.01, "Other Events," is a catch-all that companies use to disclose things voluntarily. Revolve filed under Items 8.01 and 9.01, not 1.05, which fits with its statement that it does not believe the incident will have a material impact.

This is a common pattern: a company puts the incident on the public record without formally calling it material. For readers, the filing item tells you how the company judges the business impact. It does not tell you how serious the incident is for the customers whose cards were exposed.

What does "automated means" mean here?

Revolve doesn't explain, and none of the sources say how the attacker got in or what "automated means" covered. The wording points to scripted or tool-driven collection rather than a person reading records by hand, but the filing doesn't say whether the attacker came in through customer accounts, a back-end system, or something else. Until Revolve or investigators say more, any specific explanation of the method is guesswork, and we won't offer one.

The filing also lists only certain fields: name, contact information, card number and expiration date. It does not mention card security codes (CVV) among the exposed data. That matters, because the security code is one of the checks card networks and merchants use to block online fraud. But leaving it off the list is not a guarantee. Cardholders should assume the numbers can be misused and act on that basis.

How many people are affected?

The total is unknown. The Record reports that Revolve did not say how many people were affected overall. The two state counts on record, 127,200 in Texas and 1,328 in Vermont, cover only those states, and notifications were also filed in Massachusetts. Revolve sells to customers across the country, so the national total is very likely higher than the Texas figure alone, but no source gives it.

For a sense of scale, The Record notes that Revolve reported $347.4 million in net sales in its last fiscal quarter. Revolve is a sizable retailer, and its customer base reaches well beyond two states.

Is there a lawsuit?

Not yet, according to Settlement Insight, an independent information site that tracks breach litigation. As of October 30 it found no lawsuit, settlement or claim form on file. The site is not a primary source and says it is not a law firm, but its advice to customers is sound: if you saved a card with Revolve, contact your bank.

Is this part of a wider pattern?

Fashion retail has been a frequent target. The Record says payment card information held by fashion retailers continues to be a valued target for cybercriminals, and notes that large brands including Asos, Levi Strauss, Foschini Group, Mango, North Face, Harrods, M&S and The Co-op have all faced cyberattacks over the last two years. No source links the Revolve intrusion to any of those incidents or to any named threat group, and Revolve has not attributed the attack.

What It Means for Defenders

Who is affected: Revolve customers who saved a payment card in their online shopping account. According to the filing, the exposed data is name, contact information, card number and card expiration date. Revolve has published no fixed versions or technical indicators. This was an incident at the company, not a software vulnerability that customers can patch.

If you are a Revolve customer with a saved card:

  • Call your card issuer, tell them the card was saved at a retailer that reported a breach, and ask about a replacement card number. Settlement Insight also says the useful move is with your bank. Reissuing the card is the most direct way to make a stolen number worthless.
  • Read your recent statements for charges you don't recognize, and turn on transaction alerts in your bank's app if you haven't already.
  • Expect phishing. The attacker may have names and contact details tied to a known retailer, which makes convincing fake "Revolve security notice" or "refund" messages easy to write. Don't follow links in unexpected messages about the breach. Go to the retailer's site or your bank directly.
  • Think about deleting saved cards from retail accounts you don't use often. If no card is stored, none can be stolen.

If you run IT or security for a small business: Employees who used a corporate card at Revolve, or a personal card they also use for expenses, should report it to whoever manages the card program so the card can be reissued. Warn staff about breach-themed phishing in your next security reminder.

If you run an e-commerce platform: This incident shows how much risk comes with storing customer card data. The less of it you keep, and the more you hand off to a tokenizing payment processor, the less an intruder can take. Revolve says the data may have been obtained "through automated means." Whatever the actual mechanism turns out to be, monitoring for automated, high-volume access to account and payment data, and rate-limiting it, belongs in any retail defense plan. Check that your incident response plan covers both state breach notices and, if you are publicly traded, the SEC decision between Item 1.05 and 8.01.

What's still unknown: when the intrusion began and ended, how the attacker got in, the total number of victims, and whether any of the stolen card data has turned up for sale. ZeroDayFeed will update this story if Revolve or investigators release more.

Sources