Anyone who ticked the box to keep a card on file at Revolve’s online checkout is the customer this breach is about, and the number of people in that group just grew far larger than first reported. Revolve told the Indiana Attorney General’s Office that 1,515,073 individuals were affected, roughly 1.5 million shoppers, against about 197,000 people across five other state notices.
Read next on Morning Overview: Winter weather advisories cover I-80, I-70 and the Bighorns with up to 15 inches of snow
The fashion retailer says an unauthorized party got into some of its systems, including its e-commerce platform, on Sept. 11. Revolve became aware of the intrusion on Sept. 29 and disclosed it publicly on Oct. 29, which means the first public warning arrived seven weeks after the break-in and a month after the company says it understood what had happened. For a shopper with a saved card, that gap is the window in which stolen numbers could have been tested or sold before any notice reached an inbox.
In its Form 8-K filed with the Securities and Exchange Commission on Oct. 29, Revolve said “certain of its systems” were accessed without authorization and that it had confirmed the unauthorized activity was remediated. The company said it notified federal law enforcement, brought in outside cybersecurity experts and is adding security measures. It added that the incident caused no operational disruption and that it does not currently expect a material impact on its business, while saying its assessment is continuing.
From 197,000 to 1,515,073 across state filings
The jump comes from comparing regulator records. Notices to attorneys general in Iowa, Massachusetts, South Carolina, Texas and Vermont covered about 197,000 people combined, and SecurityWeek’s first report put the total at no fewer than 180,000. The Record found Texas alone at 127,200 people and Vermont at 1,328 victims, with Massachusetts filing a notice that carried no count.
Then Eduard Kovacs of SecurityWeek reported on Nov. 9 that the Indiana filing listed 1,515,073 individuals, a number roughly eight times the five-state tally. The 8-K itself gave no victim count, and Revolve had not published a total before that, so the state filings have been the only place the scale of the breach could be read.
One caution applies to the big number. Malwarebytes, which also traced the 1,515,073 figure through state records, noted that Revolve has not confirmed a national total and that the SEC filing is silent on one. The count therefore rests on a state regulator’s record, not on a company announcement.
Saved card numbers, expiration dates and what stayed out
Revolve says the intruder may have used automated means to collect names, contact information including mailing addresses, payment card numbers and card expiration dates. The exposure was limited to shoppers who had chosen to store a payment method in their online accounts, so a guest checkout without a saved card would not fall in the affected group.
The 8-K does not mention card security codes, and nothing in the filings says whether the stored numbers were masked or held by Revolve or by a payment processor. No hacking group has claimed the attack, and Revolve has not explained how the attackers got in. Those gaps leave outsiders unable to judge whether a card on file for years would have been among those taken. The Record also noted that Revolve reported $347.4 million in net sales for its latest fiscal quarter and sells more than 1,600 brands, a reminder that the saved-card feature sits at the center of a large online business, which is why a count above a million is plausible for a retailer of that size.
The notification letter and the steps Revolve lists
A sample notification letter posted by the California Attorney General comes from Revolve Group, which operates Revolve.com and FWRD.com. It repeats the Sept. 11 access date and says the company determined on Sept. 29 that names, addresses and card numbers with expiration dates were involved for certain cards, each identified in the letter by its last four digits.
The letter does not offer credit monitoring or identity protection. It points recipients to their card statements and to unauthorized-charge reports with their issuers, and it lists the free weekly credit reports at annualcreditreport.com, a free one-year fraud alert, a free security freeze placed separately with each of the three bureaus, and the Federal Trade Commission’s identity theft site. Revolve staffs a call line at 888-517-6458 from 9 a.m. to 9 p.m. Eastern on weekdays.
Malwarebytes adds a practical step the letter leaves out: remove saved card details from shopping accounts, or ask the issuer to cancel the card and issue a new number. Whether Revolve will publish its own total, and whether more state filings will move the 1.5 million figure again, remain the open questions as of Nov. 11. Malwarebytes also warns that recipients should distrust unsolicited calls, texts or emails about the breach and verify any caller claiming to represent a card issuer by dialing the number printed on the back of the card, since criminals tend to follow breach notices with fraud attempts.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Two Kentucky residents died when a small plane crashed at Missouri’s Lake of the Ozarks, and the NTSB is investigating
- A handful of car transmissions are so tough that mechanics say they almost never die
- Melting permafrost is setting off a newly identified kind of catastrophic landslide, scientists say
- Cadillac cut the price of its cheapest EV, which goes up to 317 miles on a charge
