For: people who have a Revolve account with a saved card, and online shops that let customers store cards. This article is based on the Texas Attorney General's listing and press reports of Revolve's filing, and it does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who have a Revolve account with a saved card, and online shops that let customers store cards.
- Confirmed so farSee the table ↓
- Names
- Credit or debit card numbers
- Texas count
- Not yet confirmed
- Total number of people affected across all states
- Whether card security codes were involved
- When the activity happened and how it was found
1 more
- What Revolve is offering affected customers
- What to do nowSee the steps ↓
- Check your card statements
- Ask your card issuer about a new card
- Do not trust messages that quote your order history
1 more
- Stop saving cards you do not need to save
- Where to verify (source)All sources ↓
- Texas Attorney General, Data Security Breach Reports, entry "Revolve Group, Inc." (posted 10/30/2026)
- Last checked
- As of November 1, 2026
Follow-up plans and what we checked
We could not read Revolve's customer notice or its securities filing ourselves, so details beyond the Texas listing and press reports are open. Check the sources below for updates.
What Revolve customers should do today
Check your card statements
Look at the card you saved on your Revolve account. Scan the last few weeks and keep checking for the next few months, because stolen card data is sometimes used later and in small amounts.
If you see a charge you do not recognise, tell your card issuer straight away.
Ask your card issuer about a new card
The reported data includes the card number and expiry date. Whether the security code was involved is not stated. Call the number on the back of your card and ask whether to reissue it.
This is this site's advice, not a Revolve instruction. If you reuse the same card on other sites or subscriptions, a new card means updating those too.
Do not trust messages that quote your order history
Your name, contact details and past orders let a scammer write a message that looks like it came from the shop or your bank. Do not tap links or call numbers in an unsolicited message about this breach, a refund or a failed payment.
Open the Revolve site or app yourself, or use the number on your card. See What is phishing? and Smartphone security basics.
Stop saving cards you do not need to save
After you have dealt with the card, remove saved cards from shop accounts you rarely use. Consider a wallet or one-time card number from your issuer if it offers one. Also use a unique password and a second check on the account (Choosing multi-factor authentication).
What happened (from the Texas listing and press reports)
Oct 29, 2026
Revolve files a Form 8-K with the US Securities and Exchange Commission, according to The Record. We did not read the filing itself.Oct 30, 2026
The Texas Attorney General's data breach report lists Revolve Group, Inc., Cerritos, California: 127,200 Texans; notice provided; notice methods "posted at company website or special website" and "U.S. mail"; posted 10/30/2026.Oct 30, 2026
The Record reports the disclosure. It also reports 1,328 Vermont residents and a Massachusetts filing without a count.
- Who
- Revolve Group, Inc., a US online fashion retailer (Texas AG listing)
- Data (Texas listing)
- Name of individual; financial information such as a credit or debit card number
- Data (press, from the filing)
- Names, contact details, and saved payment card numbers and expiry dates, for customers who saved payment information in their online accounts (The Record)
- Method
- "Automated means" (The Record, from the filing)
- Texas
- 127,200 people (Texas Attorney General listing, posted Oct 30, 2026)
- Response
- Notified federal law enforcement and engaged outside cybersecurity experts; no operational disruption; no material impact expected (The Record, from the filing)
What is known and what is not
| Item | What was published | Status |
|---|---|---|
| Names | Listed by the Texas AG; named in press report | Confirmed (Texas AG listing) |
| Credit or debit card numbers | Category listed by the Texas AG | Confirmed (Texas AG listing) |
| Card expiry dates | In the filing, per The Record | Reported (The Record) |
| Contact details | In the filing, per The Record | Reported (The Record) |
| Card security code (CVV) | Not stated in the sources we read | Not stated |
| Texas count | 127,200 | Confirmed (Texas AG listing) |
| Vermont count | 1,328 | Reported (The Record) |
| Massachusetts | Filing made, no count | Reported (The Record) |
| Total across all states | Not published in what we read | Not disclosed |
| Dates of the activity and discovery | Not stated in what we read | Not disclosed |
| Cause | "Automated means" only | No technical detail |
| Credit monitoring or other support | Not stated in what we read | Unknown |
| Misuse of the data | Not stated | No information |
The Record's headline misspells the name
The Record's headline reads "Resolve"; the article and the Texas listing say Revolve (Revolve Group, Inc.). This site uses Revolve.
Name and contact details
Saved card number
Card expiry date
↓
Small test charges, then larger ones
Fake refund or payment-problem messages
Calls that quote your order
↓
Check statements
Ask the issuer about reissuing
Open the real site yourself
What data like this makes possible
This section is general, not a report of what has happened.
- Card number plus expiry date: enough for some online merchants to accept a payment, depending on their checks. Criminals often try small charges first to see whether a card works.
- Name plus contact details plus order history: lets someone write a fake message that mentions a real purchase. Fake refund and "payment failed" messages are the usual form.
- Why the security code matters: many shops require it. The sources we read do not say whether it was involved, so ask your issuer instead of assuming.
If anything unexpected reaches you, close it and contact the shop or your issuer through a number or app you already trust.
For shops that let customers save cards
Revolve's disclosure is short, so only two lessons follow from what is published.
Treat repeated automated access as an alarm
The disclosure says the data was accessed by "automated means". Rate limits, bot detection and alerts on bulk account reads are common defences. We do not know what was in place at Revolve.
Store only what you must
Hand card storage to your payment provider so your own systems keep tokens, not card numbers. See a Japanese card-skimming case for what happens when card data passes through a shop's own pages.
Sources (public record)
We could not read Revolve's securities filing, its customer notice, or the Vermont and Massachusetts notices with our tools. The Texas listing is a regulator record we opened. The rest comes from The Record's report.
- Texas Attorney General, Data Security Breach Reports, entry "Revolve Group, Inc." (posted 10/30/2026) — oag.my.site.com
- The Record, "Fashion retailer Resolve says hackers stole payment card information" (Oct 30, 2026) — therecord.media
Update history
2026-11-01: First version, based on the Texas Attorney General listing of October 30 and The Record's report of the same day.
Read next
- Another retailer breach this month: ASOS customer data breach
- Card data stolen at checkout: PhotoGoods card skimming
- Defending against impersonation: What is phishing? / Choosing multi-factor authentication
- Other 2026 cases: Data breaches and cyberattacks in 2026