Security notice
Run an online store? Revolve says saved card numbers may have been taken from customer accounts.
Revolve Group, which runs Revolve.com and FWRD.com, told the SEC on October 29, 2026 that it believes an unauthorized actor "may have obtained, through automated means" the name, contact information, card number and card expiration date of certain customers who saved a card in their online account. Revolve's letter to Iowa's attorney general says the actor accessed its platform on September 11, 2026. Neither document lists the three-digit security code (CVV). Revolve has not said how many people are affected or how the actor got in. Malwarebytes reports a figure of about 1.5 million from Texas records, which Revolve has not confirmed. This is not a software flaw, so there is nothing to patch and no CVE. If you saved a card at Revolve or FWRD, read your card statements line by line and consider asking your card issuer for a new card. If you run a store, this is a reminder to find out what card data your store keeps.
What happened
- What Revolve says. In Revolve's SEC filing, dated October 29, 2026, Revolve says it "recently became aware of unauthorized access to certain of its systems," that it started its incident response, told federal law enforcement, hired outside cybersecurity experts and "confirmed the unauthorized activity was remediated." It says it believes an unauthorized actor "may have obtained, through automated means," the data below. It says there was no disruption of service and it does not expect a material impact on its business. (SEC filing)
- What data. The filing says "the name, contact information, payment card number and payment card expiration date." Revolve's letter to the Iowa attorney general says the data contained the customer's name and address, and the card number and expiry date. The filing and the letter do not list a security code (CVV) and do not say whether one was or was not involved. Malwarebytes points out that card numbers and expiry dates may still be enough to buy from some online stores, and can make phishing messages more convincing. (SEC filing, Iowa letter, Malwarebytes)
- Who. Only customers who saved a payment card in their Revolve online account. Customers who did not save a card are not described as affected. (SEC filing, Malwarebytes)
- When. The letter to Iowa says that on September 11, 2026 an unauthorized actor accessed the platform, and that on September 29, 2026 Revolve "determined" what data was involved. It says Revolve began mailing notices to Iowa residents on October 29. Malwarebytes says Texas records list September 29 as the discovery date. Revolve has not said when it first learned of the activity. (Iowa letter, Malwarebytes)
- How many: not confirmed. The SEC filing gives no number. The letter to Iowa counts 3,918 Iowa residents. Malwarebytes says the public Texas attorney general listing shows 127,200 Texans, and that it found a total of 1,515,073 in data the Texas site returns when searching for Revolve, labeled as the total number of people affected, which the public listing does not display. Revolve has not confirmed any total. We could not open the Texas record ourselves. (Iowa letter, Malwarebytes)
- How the actor got in: not said. Revolve has not said how the attacker reached the saved card data. "Automated means" is all the filing says. We do not know whether it was a software flaw, stolen logins or something else, and we are not guessing. Malwarebytes says no group has claimed responsibility. (SEC filing, Malwarebytes)
- No fix to install. This is a breach at one retailer, not a flaw in software that you run, so there is no CVE, version or patch. (SEC filing)
Who should worry
Two groups. The first is shoppers: anyone who saved a card in a Revolve or FWRD account. The second is people who run online stores, because the data taken was the kind any store with customer accounts and saved cards could hold. Ask about this if any of these are true:
- You shopped at Revolve.com or FWRD.com and saved a card in your account. You may get a letter in the mail.
- You run an online store that lets customers save a card, and you are not sure what your store actually keeps.
- You are not sure whether your store keeps card numbers itself or leaves them with a payment provider.
- An agency or developer set up your store and its checkout, and you do not know how saved cards work.
- You run a web agency or host and look after online stores for clients.
If you did not shop at Revolve or FWRD and your site takes no cards, this notice does not apply to you.
What to do now
If you saved a card at Revolve or FWRD. This follows Revolve's letter and Malwarebytes.
- Read your statements line by line, and look for small charges and merchant names you do not recognize.
- Report anything you did not make to your card issuer right away. Revolve's letter says payment card rules generally provide that cardholders are not responsible for unauthorized charges reported in a timely manner.
- Consider asking your card issuer to cancel the card and send a new number. Malwarebytes suggests this, since the old number becomes unusable.
- Consider removing saved cards from shopping accounts. Malwarebytes says a password manager can store card autofill data instead.
- Be careful with calls, texts and emails about this. Scammers can use real card details to sound convincing. If someone says they are from your card issuer, call the number printed on your card. Do not give out the security code.
If you run an online store. The sources do not say how Revolve was breached, so we cannot say which of these would have stopped it, and we are not claiming that any tool, including EverThread, would have prevented or caught it. These are general steps, not from Revolve or the sources above.
- Find out what your store keeps. Ask your developer, platform or payment provider whether your store stores card numbers, or only a token or the last four digits that the provider gives you. Many payment providers hold the card data on their side. Do not store full card numbers yourself if you can avoid it.
- Decide whether customers need to save cards. If you offer it, ask your provider how saved cards are stored and who on your team can see them.
- Look at who can get into your store's admin. Remove accounts that are no longer needed, give staff only the access they need, and turn on two-step sign-in for admin and staff accounts if your platform offers it.
- Keep the store software, plugins and themes updated, and remove the ones you do not use.
- Know who to call. Keep the phone numbers of your payment provider, host and developer where you can find them, so that if you ever suspect card data was exposed, you can tell your payment provider right away and ask what they require.
What to send your developer, agency or host
Revolve Group reported on October 29, 2026 (SEC Form 8-K) that an unauthorized actor may have obtained, through automated means, the name, contact information, card number and card expiry date of customers who saved a card in their online account. Revolve has not said how the actor got in. We would like to know what card data our online store keeps. Please tell us whether our store stores full card numbers or only tokens or the last four digits from our payment provider, whether customers can save cards in their accounts, who has admin access to the store, whether two-step sign-in is on for admin and staff accounts, and whether the store software, plugins and themes are up to date. Please also tell us who we should contact at our payment provider if we ever suspect card data was exposed. Sources: Revolve's SEC filing, Revolve's letter to the Iowa attorney general, Malwarebytes.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a breach at another company, Revolve. It matters to you as a shopper if you saved a card there, and as a store owner because it shows what saved card data is worth to attackers.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see what card data your store keeps, who can sign in to it or whether anyone has broken in, and we cannot tell you whether you were one of Revolve's customers. If you saved a card at Revolve or FWRD, watch for the letter and check your statements.
Was my security code (CVV) taken?
Revolve's filing and its letter to Iowa do not list it, and they do not say it was or was not involved. Malwarebytes makes the same point. (SEC filing, Iowa letter, Malwarebytes)
How many people are affected?
Revolve has not said. Malwarebytes reports about 1.5 million from Texas records, which Revolve has not confirmed, and the public Texas listing shows 127,200 Texans. (Malwarebytes)
Was it caused by bots or automated attacks?
Revolve says it believes the actor obtained the data "through automated means." It has not said what that means or how the actor got in, so we cannot say. (SEC filing, Malwarebytes)
Is there anything to update?
No. This was a breach at one company, not a flaw in software you run. The general steps for store owners above are worth doing anyway.
Where can I follow official updates?
Revolve's SEC filing page on the SEC's EDGAR site and the notice letter you receive. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- SEC: Revolve Group, Inc. Form 8-K, Item 8.01, dated October 29, 2026, checked November 3, 2026
- Iowa Attorney General: Revolve's incident notification letter and sample customer notice, dated October 29, 2026, checked November 3, 2026
- Malwarebytes: Revolve card breach: 1.5 million people may be affected, November 3, 2026, checked November 3, 2026. It cites the Massachusetts and Texas attorney general records, which we could not open ourselves.