Millions of online shoppers may have had their payment information exposed after a cyberattack hit a popular fashion retailer — and many may not yet know they’re affected. Revolve Group, Inc., the company behind online fashion platforms Revolve and FWRD, has begun notifying customers that their saved card data was compromised in a data breach discovered this fall.
The breach occurred on September 11, when an unauthorized actor gained access to Revolve’s online shopping platform. According to breach notices filed with state officials, the exposed data includes customer names, home addresses, payment card numbers, and card expiration dates. Only customers who had a saved payment method linked to their account were affected.
How Many People Were Affected?
State-level breach filings reveal the scale of the incident. A review of publicly available notices shows at least 127,200 affected Texas residents, 46,813 in Massachusetts, 17,813 in South Carolina, 3,918 in Iowa, and 1,328 in Vermont — totaling at least 197,072 people across five states. Notably, data returned by the Texas attorney general’s website for Revolve’s filing includes a separate field listing 1,515,073 people affected nationwide, though that figure does not appear in the standard public search results. Revolve has not publicly confirmed a nationwide total, and not all states make breach notices publicly searchable.
What Should Affected Customers Do Now?
If you receive a breach notification from Revolve, the most important immediate step is to review your credit and debit card statements carefully. Any unfamiliar or suspicious charges should be reported directly to your card issuer right away. You can also request that your issuer cancel the exposed card and issue a replacement with a new account number — a straightforward process that most banks and credit card companies handle quickly.
Customers with questions about the breach can reach Revolve directly by calling 888-517-6458, available Monday through Friday, 9 a.m. to 9 p.m. Eastern Time, excluding major U.S. holidays.
A Proactive Step Worth Taking Before the Next Breach
Even if you haven’t received a notice, consumer advocates recommend taking a step that costs nothing but can offer meaningful protection: freezing your credit. A credit freeze prevents lenders from accessing your credit report, making it significantly harder for thieves to open new accounts in your name using stolen personal information. While a freeze won’t reverse unauthorized charges on an already-exposed card, it can limit further damage from identity theft. You must contact each of the three major credit bureaus — Equifax, Experian, and TransUnion — separately to place or lift a freeze, but the process is free.
This report is based on a review of publicly available state breach notices conducted in accordance with established Editorial Standards ⓘ.