Revolve Group told investors on October 29 that an unauthorized actor may have used automated means to obtain names, contact details, payment card numbers and card expiration dates from customer accounts. The data belonged to shoppers who had saved a card to their online account at the fashion retailer. A filing with Texas regulators later put the count of affected Texans at 127,200, the largest figure made public so far. The filing lists four kinds of data: name, contact information, card number and expiration date.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
Revolve has not said how many people were hit in total, and it has not said when the intrusion began. A filing in Vermont lists 1,328 victims, and breach notifications have also been lodged in Massachusetts without a published count.
What Revolve told the SEC
The company disclosed the incident in a Form 8-K under Item 8.01, signed by Chief Financial Officer Jesse Timmermans and dated October 29. It said it recently became aware of unauthorized access to certain of its systems, promptly started its incident response protocols and confirmed the activity was remediated. It is now working to put enhanced security measures in place, and it told investors it had notified federal law enforcement and engaged outside cybersecurity experts. The filing does not say when the incident occurred or when Revolve discovered it.
On the business side, the 8-K reported no operational disruption or service interruption and said the company does not currently expect a material impact. That reassurance sits beside a large customer base. Revolve’s second-quarter results show $347.4 million in net sales, up 12 percent, and 3,041,000 active customers over the trailing twelve months, on a platform carrying more than 1,600 brands. Co-founders Michael Mente and Mike Karanikolas share the chief executive role.
The state breach filings and what they reveal
The Record’s Jonathan Greig reported on October 30 that Revolve told Texas regulators the day before that 127,200 people in the state had information stolen. Texas posts such notices on the attorney general’s breach-report portal, which loads its table dynamically and could not be read in text form at the time of checking, so the Texas figure rests on The Record’s reading of the filing.
Vermont’s 1,328 and the unpublished Massachusetts count show how unevenly the notices read: a single large state filing can reveal far more than the company’s own investor disclosure, which names no total.
The Massachusetts filing, published as a notice template, lists the exposed items as name and address plus the card number and expiration date, and its placeholders leave out the victim count and the date. It offers no credit monitoring. Instead it points recipients to their card statements, free credit reports, free fraud alerts and no-fee security freezes, and it tells Massachusetts residents of their right to obtain a police report and request a security freeze.
The scale of the retailer explains why a single state can produce a six-figure count. The Record notes that Revolve describes itself as the next-generation fashion retailer for Millennial and Generation Z consumers, serves more than 1,600 brands and reported $347.4 million in net sales last quarter. A shopper base of that size, with many returning customers who leave a card on file for fast checkout, gives an attacker working through accounts a large pool to draw on, though Revolve has not said how many accounts were actually accessed.
Saved cards and automated access
A stored card turns a shopping account into a payment credential. A card number and expiration date can be enough for some merchants to approve a purchase, and a phrase like automated means in the 8-K suggests the information was pulled in bulk through the account system rather than lifted one customer at a time. The filing does not describe the method, and Revolve has not said whether the three-digit security codes were stored; the 8-K lists only the number and expiration date.
Retail has seen a run of similar incidents this year, among them Levi Strauss, which The Record also covered. For Revolve shoppers the open points are practical. The company has not said when the access began, whether any cards have been used fraudulently, or whether it will offer a monitoring service. Cardholders in Texas, Vermont and Massachusetts are the only people who can currently be sure they were notified, and anyone who saved a card at the retailer has a reason to check statements.
The pattern is familiar from the rest of the sector. Beyond Levi Strauss, The Record has covered Asos, where hackers tricked an employee into approving an access push notification, and Marks & Spencer, whose profits were wiped out by a cyberattack, along with Mango, North Face, Harrods and the Co-op. Revolve’s incident differs in that its attackers reached payment data tied to saved accounts instead of locking up operations, and the company says nothing was disrupted.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
