Revolve discloses payment card data breach in SEC filing

Revolve has disclosed that hackers accessed customers’ payment card numbers and expiry dates stored on its ecommerce platform.

The online fashion retailer set out the details in an 8-K report filed with the US Securities and Exchange Commission (SEC), which states that threat actors gained access to multiple company systems. According to the filing, an initial investigation found that the attackers used automated means to obtain customer names, information, payment card numbers, and payment card expiration dates. The exposure concerns customers who had saved their payment details in their online shopping accounts on Revolve’s platform.

Revolve has not said when the attack took place and did not respond to questions the timing. The company has notified federal law enforcement agencies and appointed a cybersecurity firm to lead the recovery effort.

State filings point to the scale of the breach

The SEC filing does not give a total number of affected individuals. State-level notifications, however, give an indication of the breach’s reach. Revolve told regulators in Texas that 127,200 residents of the state had their information stolen, while 1,328 affected individuals are located in Vermont. A breach notification has also been filed in Massachusetts .

The company stated that the incident caused no operational disruption and that it does not expect a material financial impact. Revolve works with more than 1,600 brands across apparel, footwear, and accessories, and reported net sales of USD 347.4 million for the second quarter of 2026, its most recent fiscal quarter.

Stored card data as an attack surface

The breach centres on card-on-file data, the payment credentials customers choose to keep in their accounts so they can complete repeat purchases without re-entering details. Because the attackers obtained card numbers and expiry dates together with names and information, the incident affects the stored data that supports this convenience at checkout, rather than any disclosed disruption to transaction processing.

Revolve’s disclosure adds to a series of cyber incidents in fashion and retail. Over the past two years, Asos, Levi Strauss, Foschini Group, Mango, North Face, Harrods, M&S, and The Co-op have all faced cyberattacks. Payment card information held by fashion retailers remains a consistent target for cybercriminals.

News on Fraud and Fincrime

Revolve discloses payment card data breach in SEC filing

FCA secures High Court undertakings halting HTX crypto promotions

Binance hit by USD 6.3 billion hack attributed to North Korean unit

Checkout.com goes live with Visa Payment Passkey for merchants

Accertify launches partner programme for payments and commerce firms

Expert views on Fraud and Fincrime

ThetaRay after Sibos 2026: AI-native compliance moves from pilot to production

Protected without noticing: why authentication should start with the customer

Preparing fraud teams for the age of AI and agentic commerce

Beyond the claim: why financial institutions need a formal scam risk management program

The chargeback signal problem: why disputes and fraud aren't the same thing

The Paypers is a global hub for market insights, real-time news, expert interviews, and in-depth analyses and resources across payments, fintech, and the digital economy. We deliver reports, webinars, and commentary on key topics, including regulation, real-time payments, cross-border payments and ecommerce, digital identity, payment innovation and infrastructure, Open Banking, Embedded Finance, crypto, fraud and financial crime prevention, and more – all developed in collaboration with industry experts and leaders.

Crypto, Web3 and CBDC

Payment Orchestration

TradFi and DeFi Convergence

KYC, KYB and Digital Identity

No part of this site can be reproduced without explicit permission of The Paypers (v2.7).