What happened. Revolve Group (NYSE: RVLV), the Cerritos, California online retailer behind REVOLVE and FWRD, says an unauthorized actor got into its online shopping platform on Sept 11, 2026. It determined on Sept 29 what data was involved, disclosed the incident in an SEC 8-K under Item 8.01 (not the Item 1.05 used for material cyber incidents) on Oct 29, and began mailing customer letters the same day. The 8-K gave no customer count. Its notice to the Indiana Attorney General now puts it at 1,515,073 people, far above the roughly 197,000 covered by its earlier notices to five other states.
What was exposed. Names, addresses and contact details, plus payment card numbers and expiration dates, only for shoppers who saved a card to their account. The company says the data may have been collected "through automated means." Card security codes and passwords are not mentioned either way. The entry point, any third party involved and the attacker are Undisclosed, and no group has claimed it. Revolve says there was no service disruption and it does not expect a material business impact.
Why this matters to an enterprise. Card number plus expiry plus billing address is enough for a lot of card-not-present fraud, even without the CVV. "Automated means" against the shopping platform points to scripted bulk pulling of stored-card data, so watch for abnormal read volumes on account and wallet endpoints, not just logins. If you store cards yourself, tokenize them so the app never holds the full number. Expect Revolve-branded phishing aimed at staff and customers.