Revolve Says Hackers Stole Saved Customer Card Details

Online fashion retailer Revolve says attackers obtained customer names, contact details and saved payment card information from its shopping platform. Customers who stored a card with Revolve should review that account and their card activity now, even if they have not received a breach notice.

What happened

Revolve disclosed the incident in a filing with the Securities and Exchange Commission, according to The Record. The company said criminals entered multiple systems and used automated methods to collect information from customers who had saved payment details in their Revolve accounts.

The exposed data included names, contact information, card numbers and card expiration dates. The source did not say that card security codes, account passwords or Social Security numbers were taken. Revolve also did not disclose when the attack happened.

The retailer told regulators that 127,200 people in Texas and 1,328 people in Vermont were affected. It also filed breach notices in Massachusetts, but the total number of affected customers nationwide has not been disclosed.

Revolve said the incident did not interrupt its operations. The company notified federal law enforcement and brought in a cybersecurity firm to assist with its investigation and recovery.

Who is affected

The known risk applies to Revolve customers who stored payment information in their online shopping accounts. People who checked out without saving a card are not identified as victims in the available source, although Revolve has not publicly described the full scope of the breach.

Customers in Texas, Vermont and Massachusetts are specifically mentioned in regulatory filings. People in other states should not assume they are unaffected because a nationwide victim count has not been released.

What to do now

1. Check for a notice from Revolve. Search your email inbox and spam folder for messages about the incident. Do not click unexpected links; sign in by typing Revolve’s address yourself or using its official app.

2. Review the card you saved with Revolve. Open your bank or card issuer’s official app and examine recent transactions, including small purchases that may be easy to miss.

3. Report anything unfamiliar immediately. Use the fraud-reporting option in the issuer’s app or call the number printed on the back of the card. Ask whether the card should be locked or replaced.

4. Remove stored payment information if you no longer need it. Sign in to Revolve directly, open the account’s payment or billing settings, and delete saved cards you do not regularly use. Menu names may vary.

5. Change a reused password. The available report does not say Revolve passwords were stolen. However, if your Revolve password is also used anywhere else, give each account a different password and store the new credentials in a password manager.

6. Keep watching future statements. Revolve has not disclosed the attack date, the complete number of victims or whether additional types of information were involved. Preserve any breach notice in case the company later provides more details or assistance.